Last Updated on October 30, 2024 by Owen McGab Enaohwo
Insider threats are on the rise. Business today can no longer ignore them and is intensively preparing for counteractions. Companies that choose to ignore it or save on implementing new security systems suffer serious losses. Many of them were seriously affected by data breaches, and only then did they take security measures.
Businesses that want to secure themselves against leaks of confidential information should responsibly address the problem. Irrational savings on IT-security will result in considerable losses in the near future. The best option is to resort to professional software tools or services that specialize in providing high-quality protection systems designed to prevent insiders from accessing important data. Such systems can easily integrate with your existing infrastructure. The market offers a sufficient number of ready-made solutions that provide protection against insiders and leaks.
However, there are other measures you can take to avoid malicious hacker/insider attacks, ensure productive employee performance and reliable data protection in your company.
Even though there is no such thing as perfect anti-insider software, there’s always a way out. The key is to effectively combine smart preventive solutions and apply a set of different security measures. Today we’re going to discuss them. But first, let’s find out who insiders really are.
Insiders. Who are they?
An insider is an employee of an organization who has access to information that is not available to the general public. They can use the available information both to harm the business and to enrich themselves.
Anyone can become an insider (that is, virtually anyone), but behavioral psychology and human resources profiling can identify the mole at the interview stage or prevent data theft in any established team. Personnel psychologists distinguish six types of insiders: the “careless,” the “naive,” (or the “manipulated”), the “resentful,” the “disloyal,” the “moonlighter,” and the “undercover” (or the “mole”) insiders.
Quite situationally, some insiders can be considered the least dangerous and some are quite the opposite. Thus, “negligent” employees might inadvertently cause (often, irreversible) information leaks, while “undercover” guys’ activity is typically aimed directly at undermining your business.
Classic Insiders
To successfully identify and profile insiders within a company, you have to understand their motivating factors, personality traits, and behavior characteristics.
Malicious insiders are the classic type of insiders who aimed at causing intentional damage to the company.
Motivating factors here are:
- Revenge – in 56%-86% of cases;
- Financial gain;
- Dissatisfaction with the company policy (ideological reasons);
- Unfulfilled expectations, i.e. bad relations with colleagues, need for promotion, demotion/reduction of responsibility;
- Stressful events, i.e. the imposition of organizational sanctions;
- Desire to transfer information to a new place of work, etc.
The main goals of malicious insider attacks are sabotage (47% of cases) and financial gain from stealing information (42% of cases).
Basic traits of malicious insiders
- Men, most of whom were unmarried at the time of the attack;
- Average age between 35 and 45 years old. This is when the connection between personal and professional life is most significant; divorces and career changes often peak during this period;
- Previously arrested;
- About 50% of insiders were working for the company at the time of the attack, and this proportion is higher for data thefts. The remainder were former employees;
- More than 50% were also employed by the organization in tech positions.
Psychological traits common to malicious insiders
- Serious mental disorders – panic attacks, drug/alcohol addiction, persistent financial difficulties, gambling addiction, and poor mental health, and weak social skills.
- A tendency to escalate conflicts;
- Sense of self-righteousness combined with anger directed toward authority;
- Constant dissatisfaction with anything at work;
- Anger management problems, aggressive behavior;
- Machiavellianism, narcissism, psychopathy (“Dark Triad”);
- Introversion, self-isolation from the collective;
- Social disappointment and low self-esteem;
- Ethical flexibility;
- Low loyalty;
- Lack of empathy.
The presence of more than one of these psychological traits in an employee is a sign of a potential threat.
Typical behavior traits of classic insiders
- An employee’s interest in matters outside the scope of his or her duties;
- Unannounced absence during work hours, truancy;
- Suspicious app and software usage;
- Excessive negative comments, reviews about the organization;
- Suspicious Internet activity and social media use;
- Disputes with co-workers;
- Difficulty complying with workplace rules;
- Inadequate responses to stress;
- Poor performance.
Thus, the behavior of classical malicious insiders has a set of quite specific traits that allow us to identify them with a sufficient degree of reliability. However, in addition to classic insiders who commit malicious actions, there is a tendency for another kind of employee who is dangerous to the organization to emerge: trained insiders.
A trained insider is a perfectly loyal employee who violates information security requirements due to their own beliefs, which can and in many cases does lead to confidential data leaks, financial losses, and other issues. The main difference between a trained insider and a classic malicious insider is that the former commit these acts in the sincere belief that by doing so, they are helping the organization achieve better results.
Trained insiders don’t just appear out of nowhere. Their “birth” is the result of an overlay of organizational traits on the personalities of employees.
But enough with all the types and traits. Let’s find out how you can identify and fight insider threats.
Identifying Insider Threats
Being proactive and observing user behavior can allow organizations to catch potentially malicious insiders before they commit their frauds.
HR and IT security teams should use employee monitoring software to get insight into employees’ PC activity and monitor their behavior. Employee monitoring provides companies visibility into the day-to-day activities of insiders. They can tell exactly who works and who pretends to work, who creates customer emails all day long, and who watches YouTube, who performs their tasks efficiently and competently, and who steals data, customers, and orders, etc.
Moreover, they have to be vigilant after significant organizational events, e.g. dismissals. The most important thing is coordination between labor and IT-security teams regarding these events.
IT-security should monitor how users behave online in any of the above scenarios. For instance, in the wake of security training or certification, such as CompTIA Security+ Certification, IT teams might track how newly trained employees apply their skills, potentially flagging those who do not follow the best practices as learned. This proactive approach not only enhances security but also reinforces the value of ongoing professional development in safeguarding company assets. In the case of compromised users, unusual behavior is likely to be detected.
Top Employee Monitoring Software
ActivTrak
Veriato
SentryPC
Teramind
Hubstaff
iMonitorSoft EAM
InterGuard
Workpuls
High-quality employee monitoring software will help you protect your business and increase the efficiency of your company. With such tools, you can check the accuracy of employees’ KPIs to only pay only for hours worked, identify insiders, and get full control of remote employees and offices.
How to Prepare for Insider Threats
Given the risks posed by insider actions of loyal employees, you should take as many measures as possible to prevent or reduce the likelihood of threats. There are many things an organization can do to fight classic and trained insiders.
Preventive ways include:
- Systematic monitoring of executive discipline;
- Random IT-security compliance audits;
- Exemplary practices (punishments) for employees who violate regulations;
- Re-engineering of business processes to identify the IT-security procedures that hinder interaction with customers and reduce the effectiveness of meeting targets. Processes that disregard ease of execution and efficiency are likely to lead to the proliferation of insecure work practices;
- Involve potential trained insiders in the development of new security procedures for business tasks;
- Mandatory background checks when hiring employees, including criminal record checks;
- Psychological testing when hiring using the five-factor personality questionnaire (AKA The Big 5) and a brief measure of dark personality traits (SD3).
- Including a course on identifying insider threats among coworkers in the IT-security curriculum. Employees must clearly understand how they should act in situations when faced with insecure behavior of their co-workers;
- Implementing motivation techniques in the corporate system to encourage staff to be vigilant and alert to threats that may come from their co-workers;
- Creating a special program to help vulnerable staff members. If employees face any form of personal crisis, they should feel free to ask for help. Feedback from those who have committed acts of espionage indicates that early intervention could have prevented such acts.
Feedback from those who have committed acts of espionage indicates that early intervention could have prevented these acts.
Educate and train your employees. Conduct regular anti-phishing training. The most effective method is for the organization to send phishing emails to its users and focus the training on those users who do not recognize the email as a phishing attempt. The most effective method is for the organization to send phishing emails to its users and focus the training on those users who do not recognize the email as a phishing attempt and do not know how to enable DMARC policy. Organizations should also teach employees to recognize risky behavior among their peers and report it to their HR or IT-security departments.
Install a Data Loss Prevention (DLP) system. These systems are tools and processes developed to ensure that sensitive data is stored safely and will not be stolen or misused. Many IT-security experts choose DLPs to prevent hacker and insider threats, stop data loss on their platforms and avoid costly events. The software creates a strong protective digital firewall around your organization’s network and alerts you to all attempts to access confidential information outside your organization’s perimeter.
The system provides traffic filtering and analysis by statistical and semantic value, which makes the search for disloyal employees, insiders, and employees undercover who undermine the economic security of your business. A DLP system will notify authorized personnel of violations against established protocols, whether it’s a questionable email or printing confidential documents.
DLP System Types
- Network DLP (sensitive data protection);
- Endpoint DLP (monitors mobile devices, e.g. laptops, USB drives, external hard drives, etc., for malicious activity and unusual access);
- Storage DLP (monitors access to your cloud-based network and on-premises).
Top DLP Tools
SecureTrust
McAfee
Endpoint Protector
Symantec
Solarwinds
Check Point
Trend Micro
Avanan
Zscaler
Keep an eye out for inactive accounts. Information leaks are often caused by employees who quit their jobs and still have valid login credentials to the corporate network. However, sometimes, they are not actually the culprits. Thus, logins and passwords may fall into the hands of active employees who commit illegal actions inside the organization, diverting suspicion from themselves. To detect such individuals, use “baits” (e.g. decoy documents) and pay attention to the “traces” of their work. Conscious insiders tend to delete large volumes of files in an attempt to disguise their activities. A DLP system retains a full history of employees’ actions and offline backups of all files in the corporate network.
Talking about the “baits.” A common method of identifying insiders is “live fishing“. An intruder is constantly “scouring” the corporate network in search of critical information. You can “leave” an array of “extremely valuable” data in the public domain and see who tries to access it and send it to USB drives, external cloud storage, or attempts to print that data.
Besides the functionality of DLP systems themselves, you can actually recognize an insider during a job interview. For this, similar multi-purpose tools, e.g. interviews and experiments, are applied.
By an interview, we mean a survey processed using sociometric methods. The same methods can also be applied to an already established team. Thus, Samsung HRs analyze the corporation’s personnel for risks using a simple verbal questionnaire: “Who would you not take on a business trip with you?” or “Who would you share your new creative idea with?”, etc. Repeat surveys, with different questions, can make information even more reliable. And by analyzing the results, you can learn your employees’ typology of social behavior in a group. Conducting a sociometric technique does not take more than 15 minutes.
Now, when it comes to experiments, they usually consist of intentionally created special conditions for the observed employees to determine their behavior in certain situations. Thus, you can learn how egocentric they are, whether they can empathize with other people, etc. When they’re on probation, you can in advance ask your proven employee to provoke a newcomer by offering additional income in an unfair and illegal way.
Coordinate IT security and personnel management. You can find dozens of stories about IT-security teams that were fired because, well, wrong people were fired. Coordination between the head of IT-security and the head of HR can help with the stability of the information environment. HR can inform IT security of certain employees (those who have been passed for promotion but have not been promoted) to put them on a watch list.
Create a watchdog team to search for threats. Rather than responding to incidents after they are discovered, you should take a proactive approach. IT-security professionals can search for signs listed above to prevent disruptions before they happen.
User and Entity Behavior Analytics (UEBA) tools. UEBA solutions can track, collect, and analyze user activities and unusual data access. Using various analytical techniques, a UEBA system identifies normal and abnormal behavior. Typically, this is done by learning the normal behavior patterns during a certain period of time to create a baseline. Once created, UEBA solutions start searching for suspicious activities by comparing behavior that does not fit this pattern.
UEBA tools can often detect irregular online behavior, e.g. unusual access activities, credential abuse, unusual access patterns, abnormally large downloads or uploads of data, etc. – are clear signs of insider threats. UEBA systems can detect this unusual behavior among compromised insiders long before they gain access to critical systems and important company data.
Conclusion
Insiders and insider threats are a complex and multifaceted phenomenon that is being researched all over the world. Remember that trained insiders are no less dangerous than classic insiders because their actions generate risks for the company in both reputational and financial ways. That’s why businesses should consider providing resources to identify potential insiders or prevent their appearance.
By better understanding the different types of insiders, tools to fight them, and behaviors to consider, your organization can be better prepared to deal with these threats in the future. A combination of training, organizational alignment, and technology is the right approach to choose. Keep your data safe and your employees in control.
Author’s bio
Dmytro Sokhach is an entrepreneur and the 6-Figure Flipper Club member. Founded Admix Global (web agency) that builds websites, makes them profitable, and sells them as business.