What are 4 types of insider threats?

Insider threats remain one of the biggest issues plaguing cybersecurity. A study by Ponemon shows that the costs of insider threats leaped 31% in just two years, from $8.76 million in 2018 to $11.45 million in 2020. The same report shows that it takes companies an average of 77 days to contain an insider threat incident. Forrester predicts that insider threats will cause 31% of data breaches by the end of 2021, up from 25% in 2020.

Both government and businesses are certainly aware of the issue, but the resources required to address it often outpace the IT security budgets. Insider threat prevention needs to consider lots of things: corporate infrastructure and technologies used, data stored, data sensitivity levels, data protection measures, data security and privacy mandates, and local cultural norms and labor practices.

In this article, we will look at the problem carefully, starting with the types of insider threats and then discussing how security threat actors operate and how to identify and mitigate the risk.

What is the insider threat?

The insider threat is a security risk that comes from any individual with legitimate access to the organization’s information and assets. That includes anyone working or connected to a company, such as current and former employees, contractors, business associates and vendors.

Handpicked related content:

• [Blog post] How to mitigate the risk of employee data theft

Types of Insider Threats

There are three types of insider threats: insiders who are negligent or careless; insiders with malicious intent; and hackers who become insiders by stealing legitimate system credentials.

Unintentional

Regular users and admins can both unintentionally perform actions that put the organization at risk, such as:

• Failing to protect their credentials
• Falling victim to common attacks like phishing or social engineering
• Falling behind on security patches and updates
• Sharing confidential information due to ignorance or disregard of data sensitivity levels
• Failing to follow security policies because they overcomplicate their jobs.

Intentional

Malicious insiders can purposefully take actions that benefit them but cause harm to the organization. Motivations for attacks include:

• Espionage — A current or former employee might use their access to a company’s systems or data to gain information, such as intellectual property or proprietary data/information, with a goal to achieve a competitive advantage.
• Revenge — A former worker or another individual holding a grudge against an organization could use their access rights to damage the company or its people, for example, by attacking important systems or stealing and publishing executives’ emails or other sensitive information.
• Profit — A malicious insider could use their access to make money, for example, by diverting funds from a company’s account or selling sensitive data.

Compromised credentials

Another type of malicious insider threat is a hacker who steals valid user or admin credentials to get into the corporate IT network. Credential theft costs companies $2.79 million per year, making it the most expensive form of insider threat.

Hackers use different methods to steal credentials, including:

• Phishing emails — Individuals inside an organization receive emails disguised as legitimate business requests, often asking for information like bank routing numbers or requesting that the recipient clicks on a link to download an attachment or visit a website.
• Pass the hash — This hacking technique allows an attacker to authenticate to a remote server or service by stealing the hash of a user’s password instead of the plaintext password.
• Cracking passwords — Hackers use a variety of approaches to guess a user’s password:
  • Brute-force attacks — Hackers run a program that attempts to log on using common passwords and working through every possible character combination.
  • Dictionary attacks — This tactic involves working through different phrases and word strings instead of individual characters.
  • Spraying attacks — Hackers use a few common passwords to attack thousands of accounts at once.
  • Reverse brute-force attacks — The attackers use one password to go after multiple user accounts.

Indicators of Insider Threat

What do you need to watch for to detect an insider threat? Here are some common indicators:

• Failed or successful access to systems or data outside of working hours or without a business need
• Attempts to download or copy large amounts of data
• Use of unauthorized systems, devices and software, such as public cloud storage.
• Attempts to bypass security protocols
• Corporate policy violations

The consequences of insider threat incidents

Insider threats can cause severe and costly damage to an organization. Among the consequences are:

• Critical data loss or theft. Insiders can accidentally or deliberately destroy intellectual property, trade secrets, personal data, customer data and other critical information, wiping out years of work in an instant.
• Negative impact on organizational productivity, such as delays in vital business functions like production, operations, customer service responses, and supply chain management.
• Financial impact, including costs related to incident investigation and the remediation of systems and processes.
• Legal/regulatory impact, including fines and litigation defense costs tied to complaints from individuals and organizations affected by data breaches. For example, if a healthcare organization suffers a breach of personal health information (PHI), the affected patients are at risk of identity theft and other consequences, and the organization can be slapped with penalties by regulatory bodies.
• Loss of competitive edge. For example, a pharmaceutical company could lose years of research into a promising drug, costing them millions in potential revenue.
• Damage to reputation. It can take a long time to regain the trust of customers and shareholders.

Tips to protect your organization against an insider threat

The best security technology on the market isn’t enough to stop every insider attack. Organizations need a comprehensive security strategy in place that accounts for the potential of inside threats.

A good strategy requires a team effort and a willingness to refine business processes, even if it means changing company culture.  Insider threat protection requires a nuanced approach. Here are the essential steps to take:

1. Classify your data according to its value and sensitivity. It’s essential to understand which information has the most value, where it’s stored, and how it’s accessed and used. Data discovery and classification solutions can help your company find sensitive and regulated information, classify its sensitivity level, and analyze how the data gets used.
2. Monitor user activity across the entire network. It’s important to understand exactly who is accessing what data and what they are doing with it. Focus on monitoring critical systems and data first, and then expand the scope as necessary. Choose a monitoring tool that doesn’t just provide raw user activity events but that uses user behavior analytics to identify suspicious or risky
3. Minimize access rights and keep business accounts and personal accounts separate. Ensure that people have access to sensitive data only as necessary for their job function. Have administrators use regular user accounts for routine business functions, and grant them temporary elevated privileges as needed to complete specific tasks. Eliminating permanent admin accounts reduces the insider threat significantly.

In addition, implement security measures like these:

• • Establishing policies that prohibit password sharing
  • Removing access to resources promptly when users change roles or leave the company
  • Placing controls around third-party access
  • Requiring multi-factor authentication for access to critical systems and data
  • Regularly looking for and deleting unused accounts

1. Maintain company-wide awareness of insider threats. Have HR teams conduct risk assessments of individuals working with privileged information. All users should regularly receive comprehensive security training about what data access and distribution activity is and isn’t allowed.
2. Automate response activities. To minimize the damage an insider can do, set up automated response actions, such as temporary blocking access to data and disabling credentials that might have been compromised.

Handpicked related content:

• Insider Threat Detection: 10 Techniques for Top-to-Bottom Defense

How the Netwrix Data Security Platform can help

The Netwrix Data Security Platform simplifies insider threat detection, investigation and response. With the solution, you can:

• Reduce the damage an insider could do, accidentally or deliberately, by monitoring user access rights and identifying overexposed data
• Automatically classify the data you store so you can implement appropriate controls for different types of data
• Continuously monitor the activity of regular and privileged users, and get alerts about anomalous behavior
• Detect attempts to escalate permissions
• Investigate incidents efficiently and quickly find the best response to each attack

FAQ

What is an insider threat?

An insider threat is a user or admin account with legitimate access to company computers and data. These accounts can be misused by their owner, either accidentally or deliberately, or be compromised by outside attackers.

What are some examples of insider threats?

Examples of insider threats include a user who is negligent about security protocols and opens an email attachment containing malware; a malicious insider who steals data for a competitor (espionage), and a hacker who performs a brute-force attack to steal user credentials and gain access to sensitive corporate data.

Why is it important to identify potential insider threats?

Failing to detect insider threats can lead to data loss and system downtime. As a result, companies can face steep costs, including fines, lawsuits, incident mitigation work and reputation damage.

What are some insider threat indicators?

Signs of an insider threat include repeated attempts to access or download sensitive data, unusual use of data or applications, and attempts to bypass security protocols or violate corporate policies.

How can I mitigate the risk of insider threats?

Start by educating all employees about the potential of insider threats. Organizations should also invest in technology to classify their data and spot suspicious user behavior.

Elena Vodopyan

Elena has more than 8 years of experience in the IT industry. She started as a Public Relations Specialist at Netwrix, working on PR materials such as commentaries, articles and customer success stories. Then she transitioned to Content Marketing, where she is now responsible for delivering informative blogs and whitepapers. Elena also serves on the editorial teams for both the Netwrix Cyber Chief and SysAdmin magazines.

What are four types of insider threats?

What are examples of insider threats?

What are the three types of insider threats?

What is the most common insider threat?