Insider threat

<h2 id="overview">Overview</h2>
Insiders may have accounts giving them legitimate access to computer systems, with this access originally having been given to them to serve in the performance of their duties; these permissions could be abused to harm the organization. Insiders are often familiar with the organization's data and intellectual property as well as the methods that are in place to protect them. This makes it easier for the insider to circumvent any security controls of which they are aware. Physical proximity to data means that the insider does not need to hack into the organizational network through the outer perimeter by traversing firewalls; rather they are in the building already, often with direct access to the organization's internal network. Insider threats are harder to defend against than attacks from outsiders, since the insider already has legitimate access to the organization's information and assets.<a class="footnote-ref" id="fnref:1" href="#fn:1">1</a>
An insider may attempt to steal property or information for personal gain or to benefit another organization or country.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a> The threat to the organization could also be through malicious software left running on its computer systems by former employees, a so-called <a href="/facts/Logic_bomb/btrj2258">logic bomb</a>.

<h2 id="research">Research</h2>
Insider threat is an active area of research in academia and government.
The <a href="/facts/CERT_Coordination_Center/9JD4Y8uQ">CERT Coordination Center</a> at <a href="/facts/Carnegie-Mellon_University/XKd7L2KA">Carnegie-Mellon University</a> maintains the CERT Insider Threat Center, which includes a database of more than 850 cases of insider threats, including instances of fraud, theft and sabotage; the database is used for research and analysis.<a class="footnote-ref" id="fnref:3" href="#fn:3">3</a> CERT's Insider Threat Team also maintains an informational blog to help organizations and businesses defend themselves against insider crime.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a>
The Threat Lab and Defense Personnel and Security Research Center (DOD PERSEREC) has also recently emerged as a national resource within the United States of America. The Threat Lab hosts an annual conference, the SBS Summit.<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a> They also maintain a website that contains resources from this conference. Complimenting these efforts, a companion podcast was created, Voices from the SBS Summit.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> In 2022, the Threat Lab created an interdisciplinary journal, Counter Insider Threat Research and Practice (CITRAP) which publishes research on insider threat detection.

<h3>Findings</h3>
In the 2022 Data Breach Investigations Report (DBIR), Verizon found that 82% of breaches involved the human element, noting that employees continue to play a leading role in cybersecurity incidents and breaches.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a>
According to the UK Information Commissioners Office, 90% of all breaches reported to them in 2019 were the result of mistakes made by end users. This was up from 61% and 87% over the previous two years.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a>
A 2018 <a href="/facts/Whitepaper/ntdvp1Kx">whitepaper</a><a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> reported that 53% of companies surveyed had confirmed insider attacks against their organization in the previous 12 months, with 27% saying insider attacks have become more frequent.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a>
A report published in July 2012 on the insider threat in the U.S. <a href="/facts/Financial_sector/azqCQelN">financial sector</a><a class="footnote-ref" id="fnref:11" href="#fn:11">11</a> gives some statistics on insider threat incidents: 80% of the malicious acts were committed at work during working hours; 81% of the perpetrators planned their actions beforehand; 33% of the perpetrators were described as "difficult" and 17% as being "disgruntled". The insider was identified in 74% of cases. Financial gain was a motive in 81% of cases, revenge in 23% of cases, and 27% of the people carrying out malicious acts were in financial difficulties at the time.
The US Department of Defense Personnel Security Research Center published a report<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a> that describes approaches for detecting insider threats. Earlier it published ten case studies of insider attacks by <a href="/facts/Information_Technology_Professional/bxxt6GDY">information technology professionals</a>.<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a>
Cybersecurity experts believe that 38% of negligent insiders are victims of a <a href="/facts/Phishing/hvgfz4U8">phishing</a> attack, whereby they receive an email that appears to come from a legitimate source such as a company. These emails normally contain <a href="/facts/Malware/5ee7TLFR">malware</a> in the form of <a href="/facts/Hyperlink/LqNsa84e">hyperlinks</a>.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a>

<h2 id="typologies-and-ontologies">Typologies and ontologies</h2>
Multiple classification systems and ontologies have been proposed to classify insider threats.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a>
Traditional models of insider threat identify three broad categories:

<ul><li>Malicious insiders, which are people who take advantage of their access to inflict harm on an organization;</li>
<li>Negligent insiders, which are people who make errors and disregard policies, which place their organizations at risk; and</li>
<li>Infiltrators, who are external actors that obtain legitimate access credentials without authorization.</li></ul>
<h2 id="criticisms">Criticisms</h2>
Insider threat research has been criticized.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a> 

<ul><li>Critics have argued that insider threat is a poorly defined concept.<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a></li>
<li><a href="/facts/Forensics/4upVa2vB">Forensically</a> investigating insider <a href="/facts/Data_theft/tz3NXQI1">data theft</a> is notoriously difficult, and requires novel techniques such as <a href="/facts/Stochastic_forensics/oskA1EEF">stochastic forensics</a>.</li>
<li>Data supporting insider threat is generally proprietary (i.e., <a href="/facts/Data_encryption/16q29Fdv">encrypted data</a>).</li>
<li>Theoretical/conceptual models of insider threat are often based on loose interpretations of research in the behavioral and social sciences, using "deductive principles and intuitions of subject matter expert."</li></ul>
Adopting sociotechnical approaches, researchers have also argued for the need to consider insider threat from the perspective of social systems. Jordan Schoenherr<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a> said that "surveillance requires an understanding of how sanctioning systems are framed, how employees will respond to surveillance, what workplace norms are deemed relevant, and what ‘deviance’ means, e.g., deviation for a justified organization norm or failure to conform to an organizational norm that conflicts with general social values." By treating all employees as potential insider threats, organizations might create conditions that lead to insider threats.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Computer_security/7E5dIy7G">Computer security</a></li>
<li><a href="/facts/Mole_(espionage)/0szHCKYS">Mole (espionage)</a></li>
<li><a href="/facts/Naval_Criminal_Investigative_Service/a6t9JSto">Naval Criminal Investigative Service</a></li>
<li><a href="/facts/Threat_(computer)/5RHTbSac">Threat (computer)</a></li>
<li><a href="/facts/Confidence_trick/1XNPz6wR">Confidence trick</a></li>
<li><a href="/facts/Graft_(politics)/7K9kbTMq">Graft (politics)</a></li>
<li><a href="/facts/Shrinkage_(accounting)/QJf6mx27">Shrinkage (accounting)</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://shadowsight.io/">Insider threat monitoring, detection and mitigation technology [ShadowSight</a></li>
<li><a href="https://www.fbi.gov/news/stories/2014/march/naval-espionage-stopping-a-dangerous-insider-threat/">Naval Espionage - Stopping a Dangerous Insider Threat</a> <a href="/facts/FBI/UY93jwX6">FBI</a></li>
<li><a href="https://dtexsystems.com/blog/true-price-tag-insider-threats-findings-new-2016-cost-insider-threats-report/">Ponemon Institute Cost of an Insider Threat Report</a></li>
<li><a href="https://go1.gurucul.com/2020-Insider-Threat-Report">2020 Insider Threat Report - Gurucul</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"FBI Counterintelligence: The Insider Threat. An introduction to detecting and deterring an insider spy". Fbi.gov. Archived from the original on 10 February 2014. Retrieved 8 March 2014. <a href="https://web.archive.org/web/20140210135443/http://www.fbi.gov/about-us/investigate/counterintelligence/the-insider-threat" target="_blank">https://web.archive.org/web/20140210135443/http://www.fbi.gov/about-us/investigate/counterintelligence/the-insider-threat</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"FBI Counterintelligence: The Insider Threat. An introduction to detecting and deterring an insider spy". Fbi.gov. Archived from the original on 10 February 2014. Retrieved 8 March 2014. <a href="https://web.archive.org/web/20140210135443/http://www.fbi.gov/about-us/investigate/counterintelligence/the-insider-threat" target="_blank">https://web.archive.org/web/20140210135443/http://www.fbi.gov/about-us/investigate/counterintelligence/the-insider-threat</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">"The CERT Insider Threat Center". Cert.org. Retrieved 8 March 2014. <a href="http://www.cert.org/insider_threat/" target="_blank">http://www.cert.org/insider_threat/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">"Insider Threat Blog". CERT. Retrieved 10 August 2012. <a href="http://www.cert.org/blogs/insider_threat/" target="_blank">http://www.cert.org/blogs/insider_threat/</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">"Insider Threat Blog". ThreatLab. Retrieved 17 July 2022. <a href="https://sbssummit.com//" target="_blank">https://sbssummit.com//</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">"Voices from the SBS Summit". ThreatLab. Retrieved 17 July 2022. <a href="https://anchor.fm/threatlab/" target="_blank">https://anchor.fm/threatlab/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">"Verizon 2022 Data Breach Investigations Report (DBIR)" (PDF). Retrieved 23 May 2024. <a href="https://www.verizon.com/business/en-gb/resources/2022-data-breach-investigations-report-dbir.pdf" target="_blank">https://www.verizon.com/business/en-gb/resources/2022-data-breach-investigations-report-dbir.pdf</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">"The fight for your data: mitigating ransomware and insider threats". Information Age. 10 May 2021. Retrieved 20 June 2021. <a href="https://www.information-age.com/fight-for-your-data-mitigating-ransomware-insider-threats-123495079/" target="_blank">https://www.information-age.com/fight-for-your-data-mitigating-ransomware-insider-threats-123495079/</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"Insider Threat 2018 Report". Cybersecurity Insiders. Retrieved 13 December 2018. <a href="https://www.veriato.com/resources/whitepapers/insider-threat-report-2018" target="_blank">https://www.veriato.com/resources/whitepapers/insider-threat-report-2018</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">"2018 INSIDER THREAT REPORT" (PDF). Crowd Research Partners. 4 September 2017. Retrieved 14 June 2024. <a href="https://crowdresearchpartners.com/wp-content/uploads/2017/07/Insider-Threat-Report-2018.pdf" target="_blank">https://crowdresearchpartners.com/wp-content/uploads/2017/07/Insider-Threat-Report-2018.pdf</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">Cummings, Adam; Lewellen, Todd; McIntire, David; Moore, Andrew; Trzeciak, Randall (2012), Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S. Financial Services Sector, Software Engineering Institute, Carnegie Mellon University, (CMU/SEI-2012-SR-004) <a href="http://www.sei.cmu.edu/library/abstracts/reports/12sr004.cfm" target="_blank">http://www.sei.cmu.edu/library/abstracts/reports/12sr004.cfm</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Shaw, Eric; Fischer, Lynn; Rose, Andrée (2009), Insider Risk Evaluation and Audit (PDF), Department of Defense Personnel Security Research Center, TR 09-02 <a href="https://www.dhra.mil/Portals/52/Documents/perserec/tr09-02.pdf" target="_blank">https://www.dhra.mil/Portals/52/Documents/perserec/tr09-02.pdf</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">Shaw, Eric; Fischer, Lynn (2005), Ten Tales of Betrayal: The Threat to Corporate Infrastructures by Information Technology Insiders Analysis and Observations (PDF), archived from the original (PDF) on 14 October 2012, retrieved 18 March 2013 <a href="https://web.archive.org/web/20121014005546/http://www.dhra.mil/perserec/reports/tr05-13.pdf" target="_blank">https://web.archive.org/web/20121014005546/http://www.dhra.mil/perserec/reports/tr05-13.pdf</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">Insider threat report fortinet.com <a href="https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/insider-threat-report.pdf" target="_blank">https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/insider-threat-report.pdf</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Schoenherr, Jordan Richard; Lilja-Lolax, Kristoffer; Gioe, David (2022), "Multiple Approach Paths to Insider Threat (MAP-IT): Intentional, Ambivalent, and Unintentional Pathways to Insider Threats", Counter Insider Threat Research and Practice <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">Schoenherr, Jordan; Thommson; Robert (2020), "Insider Threat Detection: A Solution in Search of a Problem", 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), pp. 1–7, doi:10.1109/CyberSecurity49315.2020.9138862, ISBN 978-1-7281-6428-1, S2CID 220606121 <a href="978-1-7281-6428-1" target="_blank">978-1-7281-6428-1</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Coles-Kemp, Lizzie; Theoharidou, Marianthi (2010), Insider threat and information security management. In Insider threats in cyber security (pp. 45-71), Springer, Boston <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">Schoenherr, Jordan (2020), Understanding Surveillance Societies: Social Cognition and the Adoption of Surveillance Technologies, IEEE ISTAS 2020 <a href="https://www.researchgate.net/publication/348191186" target="_blank">https://www.researchgate.net/publication/348191186</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
</ol>

Insider threat open-in-new

Insider threat