Malicious insiders are usually disgruntled current employees—or disgruntled former employees whose access credentials have not been retired—who intentionally misuse their access for revenge, financial gain, or both. Some malicious insiders ‘work’ for a malicious outsider, such as a a hacker, competitor or nation-state actor—to disrupt business operations (plant malware or tamper files or applications) or to leak customer information, intellectual property, trade secrets or other sensitive data.

Some recent attacks by malicious insiders:

• At the start of the COVID-19 pandemic, a disgruntled former employee of a medical packing company used a previously created admin account to set up a fake new user account, then altered thousands of files in a way that would delay or stop shipments of personal protective equipment to hospitals and health care providers (link resides outside ibm.com).
   

• In 2022 a Twitter employee was arrested for sending Twitter users' private information to officials of the Kingdom of Saudi Arabia and the Saudi Royal family in exchange for bribes (link resides outside ibm.com). According the U.S. Department of Justice, the employee “...acted in secret as an agent of a foreign government targeting dissenting voices.” 

Negligent insiders do not have malicious intent, but create security threats through ignorance or carelessness—e.g., falling for a phishing attack, bypassing security controls to save time, losing a laptop that a cybercriminal can use to access the organization’s network, or emailing the wrong files (e.g., files containing sensitive information) to individuals outside the organization.

Among the companies surveyed in the 2022 Ponemon Cost of Insider Threats Global Report, the majority of insider threats—56 percent—resulted from careless or negligent insiders.²

Compromised insiders are legitimate users whose credentials have been stolen by outside threat actors. Threats launched via compromised insiders are the most expensive insider threats, costing victims USD 804,997 to remediate on average according to the Ponemon report.³

Often, compromised insiders are the result of negligent insider behavior. For example, in 2021 a scammer used a social engineering tactic—specifically a voice phishing (vishing) phone call—to gain access credentials to customer support systems at the trading platform Robinhood. More than 5 million customer email addresses and 2 million customer names were stolen in the attack (link resides outside ibm.com).

Because insider threats are executed in part or in full by fully credentialed users—and sometimes by privileged users—it can be especially difficult to separate careless or malicious insider threat indicators or behaviors from regular user actions and behaviors. According to one study, it takes security teams an average of 85 days to detect and contain an insider threat⁴, but some insider threats have gone undetected for years (link resides outside ibm.com).

To better detect, contain and prevent insider threats, security teams rely on a combination of practices and technologies.

Continuously training all authorized users on security policy (e.g., password hygiene, proper handling of sensitive data, reporting lost devices) and security awareness (e.g., how to recognize a phishing scam, how to properly route requests for system access or sensitive data) can help lower the risk of negligent insider threats. Training can also blunt the impact of threats overall. For example, according to Cost of a Data Breach Report 2023, the average cost of a data breach at companies with employee training was USD 232,867 less—or 5.2 percent less—than the overall average cost of a breach.

Identity and access management (IAM) focuses on managing user identities, authentication and access permissions, in a way that ensures the right users and devices can access the right reasons at the right time. (Privileged access management, a sub-discipline of IAM, focuses on finer-grained control over access privileges granted to users, applications, administrative accounts and devices.)

A key IAM function for preventing insider attacks is identity lifecycle management. Limiting the permissions of a departing disgruntled employee or immediately decommissioning accounts of users who have left the company are examples of identity lifecycle management actions that can reduce the risk of insider threats.

User behavior analytics (UBA) applies advanced data analytics and artificial intelligence (AI) to model baseline user behaviors and detect abnormalities that can indicate and emerging or ongoing cyberthreats, including potential insider threats. (A closely related technology, user and entity behavior analytics or UEBA, expands these capabilities to detect abnormal behaviors in IoT sensors and other endpoint devices).

UBA is frequently used together with security information and event management (SIEM), which collects and correlates and analyzes security-related data from across the enterprise.

Offensive security (or OffSec) uses adversarial tactics—the same tactics bad actors use in real-world attacks—to strengthen network security rather than compromise it. Offensive security is conducted typically by ethical hackers—cybersecurity professionals who use hacking skills to detect and fix not only IT system flaws, but security risks and vulnerabilities in the way users respond to attacks.

Offensive security measures that can help strengthen insider threat programs include phishing simulations and red teaming, in which a team of ethical hackers launch a simulated, goal-oriented cyberattack on the organization.