Insider Threat: Types, Real Life Examples, and Preventive Measures

Why Are Insider Threats Dangerous?

According to industry research, insider threat incidents have increased over the past several years, and the cost of incidents is also growing rapidly. Insider threats can be difficult to identify even with advanced threat detection tools. This may be because insider threats often do not surface until an attack occurs.

Additionally, because malicious actors are similar to legitimate users, it can be difficult to distinguish benign activity from suspicious activity in the days, weeks, and months leading up to an attack.

In most organizations, a data breach caused by insider threats can be highly damaging, because few safeguards are in place to prevent valuable information from being stolen by someone with legitimate access.

Insider Threat Types

Negligent Workers

Many organizations focus their insider threat management programs on dealing with malicious insiders. However, negligence is much more common. Research shows that over 60% of insider-involved data breaches are largely unintentional.

Insider threats of this type unintentionally take actions that put organizations at risk. For example, an employee may save sensitive information on unsecure cloud storage, or leave an unencrypted mobile device or laptop with sensitive data unattended, allowing them to be stolen.

Departing Employees

Employees who leave a company voluntarily, and especially if they were dismissed by the company, are another common insider threat. The most common threat in this case is data theft.

All intellectual property or company data created or used by employees belongs to the company, but it is not uncommon for employees to consider their work as their own property. In one survey, a third of workers said it is a common practice to use data from previous employers for their next job. This kind of data theft can significantly impair an organization’s ability to compete in the marketplace.

Security Evaders

Security policies and controls are designed to protect the company, company data, and employees. However, these rules are often viewed as inconvenient and disruptive by employees.

Therefore, employees can use security workarounds to make their lives easier. For example, they can bypass data sharing restrictions by storing files on personal cloud drives. However, these workarounds hinder and can significantly compromise an organization’s visibility and control over its data.

Malicious Insiders

Malicious insiders are current or former employees, contractors, or trustees of organizations who abuse their authorized access to critical assets in a way that adversely affects the organization.

Malicious insiders have legitimate access to an organization’s data and are more difficult to detect than outside attackers, because they spend most of their time doing normal business. As a result, it can take a long time to detect attacks from malicious insiders. According to the Ponemon Institute’s Insider Threat Costs Report, organizations took an average of 77 days to detect and contain an insider-related security incident.

Inside Agents

Inside agents are insiders who perform data breaches and other attacks on behalf of external parties. These insiders might be tricked through social engineering, recruited through bribery, or extorted. This type of insider threat is dangerous because it provides internal access and privileges to external parties.

Third-Party Partners

Most organizations have limited control over network security practices of third-party vendors. Security controls can be audited as part of the selection process, but cannot guarantee complete security of sensitive data transferred to third parties. Therefore, it is important to protect remote connections by subcontractors, to protect against malicious employees and compromised accounts.

Research shows that most organizations provide some kind of access to networks and systems to third-party vendors or partners, and that most of these third parties have elevated privileges. These external parties pose the same risk and can cause the same harm as an organization’s personnel with similar access.

Insider Threat Examples

Microsoft

In late December 2019, security researchers uncovered a publicly accessible Microsoft customer support database containing 250 million entries accumulated over 14 years. The database contained support cases and details, customer email and IP addresses, customer geographic location, and notes made by Microsoft support agents.

The cause of the breach was a new version of security rules in the Microsoft Azure cloud. The leak was caused by a misconfiguration of these rules by a Microsoft employee. As a result, access to the database was not protected by passwords or two-factor authentication. This is an example of a negligent insider threat.

The database had been open to the public for about a month. Microsoft secured the breach the same day it was reported. Microsoft was not fined or penalized because the leaked data contained no personally identifiable information, and the company urgently addressed the breach and notified affected users.

However, only a few days after the breach, the California Consumer Privacy Act went into effect. The law imposes a fine of $750 for each person harmed as a result of a security violation. Under the new law, Microsoft would be fined millions of dollars.

Stradis Healthcare

A former vice president of finance of Stradis Healthcare, a US company, sabotaged shipments of personal protective equipment (PPE) during the COVID-19 crisis. He was repeatedly warned for abusing internal applications before being fired in March 2020.

Three days after departing, he logged into sensitive systems using a fake account he created while still at the company. This account was set up to provide access to sensitive company systems. He used this access to edit 115,000 records and delete 2,400, disrupting PPE deliveries for several days during the crucial early stages of the pandemic. The attack was motivated by a desire for revenge.

Trend Micro

A Trend Micro employee gained unauthorized access to databases used for customer support, including customer names, email addresses, support ticket numbers, and phone numbers.  The employee sold the data of 68,000 customers to a malicious third party, who used it to make fraudulent calls. During the call, the scammer masqueraded as a Trend Micro support representative.

It wasn’t until customers complained that Trend Micro discovered the attack. The employee’s account was deactivated and he was fired, and Trend Micro involved the law enforcement authorities. 

Insider Threat Indicators

Unusual Logins

Many companies have a regular pattern of user logins on a daily basis. Logins performed remotely from unusual locations or at unusual times can be a sign of a problem. Similarly, investigation of authentication logs can show unusual use of usernames like “test” or “admin” that indicate someone attempting unauthorized access. Any unusual login attempt should be investigated.

Use of Unauthorized Applications

Mission-critical systems such as CRMs, financial management applications, and ERPs should be watched closely. These systems should have a strictly defined set of users and roles. Unauthorized access to these applications and the sensitive data they contain can be devastating to a business, and so any increase in login attempts to these systems, especially from unauthorized users or roles, should be investigated immediately.

An Increase in Escalated Privileges

People with increased access to systems are an inherent threat to businesses if those systems contain sensitive information that should not fall into the wrong hands. In some cases, someone with administrative privileges might start granting privileges to other users who shouldn’t have them. In other cases, administrators might give themselves escalated privileges to gain unauthorized access to applications or data.

Excessive Data Downloads or Data Transfer

IT teams should be aware of their organization’s regular bandwidth usage and data download patterns—for data accessed on on-site networks, accessed through cloud infrastructure, and copied to computers or external drives. If there are large, unexplained data downloads, or if they happen at unusual times of the day or from odd locations, this could indicate an insider threat.

Best Practices for Insider Threat Detection and Prevention

Map Out Potential Insider Threat Exposure

Detecting insider threats is very different from traditional penetration testing, code review, or other vulnerability detection techniques. Security teams need to look at IT infrastructure differently. They should conduct an analysis of their organization’s internal teams and map each individual to potential risk areas.

Implement Strong Authentication

Having valid credentials makes the attacker’s job much easier. It doesn’t matter if they received credentials from the IT administrator, via a phishing attack, or from a co-worker’s desk. A simple user ID and password combination is not sufficient—passwords should have minimal complexity and should not be reused. Multi-factor authentication (MFA) is mandatory for all sensitive systems because in most cases it can render stolen credentials useless.

Control 3rd-Party Access

If a third-party vendor is compromised, attackers can use their access to penetrate a target organization they work with. The challenge is to ensure third parties maintain the same security standards as the organization. Because this is not always possible, third-party access should be carefully controlled and monitored.

Stop Data Exfiltration

A common goal of insider threats is the theft of intellectual property or other sensitive data. Proper control of data, monitoring access, and preventing unauthorized data transfer can prevent them from achieving their goals, if they gain access to the data. Use tools like data loss prevention (DLP) to identify data exfiltration attempts as they happen and mitigate attacks.

Respond Promptly to Suspicious Behavior

Monitor security systems and respond to suspicious activity according to your incident response policy. User Behavior Analysis (UBA) technology can help effectively spot insider threats by automatically identifying anomalous behavior. Monitor and control remote access to your organization’s infrastructure, configure alerts on all critical systems, and notify security staff through all appropriate channels.

Learn more in our detailed guides to:

• Insider threat detection (coming soon)
• Insider threat prevention (coming soon)

Traditional Tools Struggle to Detect Insider Threats

Traditional tools such as firewalls and antivirus software are able to detect outside intruders, but are powerless when it comes to insider threat detection. Fortunately, there are some tools that can help expose malicious insiders. When using any monitoring tools, it is important to first establish a baseline for normal network traffic/usage. This will allow the anomalies to stand out.

Types of insider threat detection software include:

• Network flow analysis tools
• Data loss prevention (DLP) tools
• SIEM platforms
• Whitelisting

The shift to behavior modeling methods
Trying to prevent insider threats with tools that aren’t properly suited for the job won’t protect against calamity. Therefore, there has been an understandable shift to more behavioral-based methods that can prevent these threats. These methods include:

• Machine Learning
• Heuristics/User Behavior Analytic

Insider Threat Management with Cynet

The Cynet platform provides various complementing layers to protect from insider threats:

• UBA: Continuously monitors user account logins, initiated network connections, and file interactions, forming a live baseline that reflects the legitimate behavior of each user.
• User Activity Rules: Cynet enables operators to flag suspicious behavior patterns (such as connecting to resources at irregular times, accessing resources that are out of the employee’s professional domain, etc.)
• Network Behavior Monitoring: Cynet monitors all network traffic to disclose various data exfiltration attempts (connecting to a unique address, DNS\ICMP tunneling, etc.)

Learn more about preventing insider threats with Cynet

See Additional Guides on Key Cybersecurity Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of cybersecurity.

XDR

Authored by Cynet

• What Is Extended Detection and Response (XDR)? Complete Guide
• XDR Security Solutions: Get to Know the Top 8
• Cisco XDR: SecureX Suite at a Glance

Zero-Day Attack

Authored by Cynet

• Zero-Day Attacks, Exploits, and Vulnerabilities: A Complete Guide
• 5 Ways to Defend Against Zero-Day Malware
• What is a Zero-Day Exploit?

Managed Firewall

Authored by Atlantic

• Managed Firewall Service – Get Pricing and Firewall Service Description 
• What is a WAF (Web Application Firewall)?
• Are Cloud Data Breaches Getting Better or Worse?