FAQs
What Is An Insider Threat?
We are naturally suspicious of external actors and entities trying to gain access to our networks. This attitude makes sense – there is no reason why an innocent external entity should want to force access to your network. This attitude defends against threats like phishing attacks, malware, and ransomware. Most cybersecurity tools work to prevent hackers from attacking networks or other company resources using these types of attacks by setting up barriers that effectively block them from entry or tip off users to suspicious activity that they can flag up for investigation.
The threat, however, does not end here. With insider threats the call is coming from inside the organization.
An insider threat is a cyberattack where a user that already has access to a network, initiates a breach. This could be a current of former employee, board member, consultant, or business partner who has some level of privileged access. Typically, an individual will use their login credentials to access data and resources, causing harm to the company’s equipment, networks, information, or systems.
Insider threats might involve unauthorized information disclosure, corruption, theft, sabotage, or espionage. That being said, a large proportion of insider threats arise through negligence and user error. This might involve the release of valuable, sensitive information, or a failure to adequately secure infrastructure.
Types Of Insider Threats
Insider threats occur when individuals breach an organization’s security, leading to data loss or other security exploits. There are a variety of forms an insider attack can take, including: intentional, unintentional, third-party threats, malicious threats, and collusive threats.
Intentional. When an insider attack is intentional this means an individual has set out with the intention of causing an organization harm. This could be to cause reputational damage or financial loss. Intentional insider attacks are often carried out as a form of retribution due to a perceived wrongdoing by a disgruntled employee.
Unintentional. Most insider threats are not carried out deliberately but are caused by unintentional mistakes. Employee negligence, for instance, can result in data being lost or stolen. Unintentional data leaks include mistakenly clicking on malicious links or opening malicious attachments in phishing emails, sending sensitive information to unauthorized email addresses, and not deleting sensitive information correctly. These threats can be mitigated through focusing on educating employees on how to recognize risky actions and to follow security best practices.
Third-party threats. This type of insider threat involves someone who is not a direct employee, but who is involved with the organization (like a contractor or business partner). Their actions, malicious or innocent, result in security becoming compromised. This category of insider threat describes identity, rather than intention.
Malicious threats. These are insider threats carried out with intent to cause harm, whether that be for the individual’s personal or professional benefit or as an act of revenge in retaliation for a perceived wrong. Malicious insider threats are particularly insidious because, due to their existing relationship with the organization, these individuals understand the organization and therefore know what activities will be most damaging or have the highest chance of succeeding. Malicious insiders might target company directors, leak sensitive data, steal data, or sabotage corporate systems and equipment.
Collusive threats. This is a type of malicious insider who is operating as part of a team with someone outside of the organization. These external partners could be third party organizations, rival companies, or even cyber criminals who wish to steal intellectual property or sabotage operations for their own gain. By combining someone who has knowledge of the organization, with a third-party with cyberattack experience, this type of attack can be very effective.
