Keys to Mitigating Insider Threats

Cyber threats can come from anywhere. For organizations facing an onslaught of external attacks, it’s easy to forget that fact. However, insider threats have fast become an equally serious threat to modern businesses; research from Gurucul revealed that 74% of organizations felt insider attacks have become more frequent – up 6% from the previous year.  

Organizations must recognize that a security program is only complete with effective insider threat mitigation protocols. It’s no use armoring your back if you leave your soft underbelly exposed. This article will outline some best practices for mitigating insider threats.  

Defining Insider Threats  

Organizations need a working understanding of what an insider threat is before they can mitigate them. An insider threat is anyone using their current or former access to or knowledge of an organization’s resources, including personnel, facilities, information, equipment, networks, and systems, to harm the organization.   

According to the Cybersecurity and Infrastructure Security Agency (CISA), there are two primary types of insider threats:  

• Unintentional Threat – Unintentional insiders include individuals who expose an organization to threats through negligence or accident.
  • Negligent insiders are generally familiar with security protocols but choose to ignore them. 
  • Accidental insiders mistakenly cause an unintended risk to an organization, such as by clicking on a phishing link.  
• Intentional Threat – Often referred to as “malicious insiders,” intentional threats are individuals who deliberately expose an organization to harm for personal gain or to exact revenge.  

Detecting and Identifying Insider Threats  

Detecting and identifying insider threats relies on establishing what normal vs. insider threat activity looks like.  

Training employees is the most affordable method of detecting insider threats and is most suitable for small to medium-sized businesses (SMBs). Employees should be able to identify the warning signs of an insider threat and anonymously report any suspicions to the security team. Potential signs of an insider threat include employees who:  

• Excessively complain about their employer 
• Abuse drugs or alcohol 
• Work unusual hours without authorization 
• Have a gambling problem 
• Express unwarranted interest in areas outside their duties 
• Display signs of mental illness  
• Copy large amounts of information without authorization 
• Log in from unusual locations 
• Access resources unrelated to their responsibilities 

Employees must also know how to avoid becoming an unintentional insider threat. Regular training teaching staff how to identify cyber threats, such as phishing scams or ransomware attacks, is essential to mitigating insider threats. Organizations should remember that insider threats are constantly evolving and keep staff up to date; just this year, some of the world’s largest corporations fell afoul of an unintentional insider threat involving ChatGPT.  

Organizations that require more sophisticated insider threat mitigation should consider artificial intelligence (AI) and machine learning (ML) tools. Organizations can establish normal behavior by inputting behavior logs, system logs, and access patterns, so AI/ML tools can flag any outliers.  

Assessing Insider Threats  

Carrying out an insider threat risk assessment is crucial to mitigating insider threats. Organizations should compile and analyze information about any person of concern with the interest, motive, intention, and capability of causing harm through insider activity.  

There are several freely available insider threat assessment resources - the National Protective Security Authority’s (NPSA) Insider Risk Assessment, for example – but any insider threat assessment must include the following stages:

• Identifying an organization’s critical assets 
• Identifying threats based on various individuals’ intent and capability 
• Assessing the likelihood of those threats coming to fruition 
• Evaluate the business impacts of threats 
• Reviewing the adequacy of existing countermeasures  
• Proposing new measures to reduce security risks 

Managing Insider Threats  

Once an organization has defined, detected, and assessed insider threats, it must prevent and manage them. One of the simplest ways to do this is to implement strong user authentication and access controls, such as multi-factor (MFA) and biometric authentication. This will ensure that users are who they claim to be. 

From there, organizations should look to insider risk management tools, keeping in mind that traditional insider risk management tools are limited because they are passive, inundate security teams with false alerts, and detect attacks without stopping them.

The most effective insider risk management tools combine behavioral and data analysis to distinguish between malicious and innocuous activity. Traditional tools, for example, would issue an alert every time an employee extracted data from an organization’s system, even if that information wasn’t sensitive. Modern insider risk management tools only issue warnings when staff exfiltrates sensitive corporate data.  

It’s also important to remember that not all insider threats are immediately apparent; traditional insider risk management tools often fail to identify slow-burn insider threats that unfold over weeks or months. Look for an insider risk management tool that stores records indefinitely and correlates events over more extended periods.  

Finally, find an insider risk management tool that does more than detect attacks; find one that stops them. Security teams can’t be perpetually on duty, ready to thwart an insider threat as soon as one arises. The best insider threat management tools take immediate action when they detect an attack, blocking data exfiltration across all channels, including cloud, email, websites, removable storage devices, Apple AirDrop, and more.

---

About the Author: Josh is a Content writer at Bora. He graduated with a degree in Journalism in 2021 and has a background in cybersecurity PR. He's written on a wide range of topics, from AI to Zero Trust, and is particularly interested in the impacts of cybersecurity on the wider economy.