What is insider risk?
When it comes to insider risk the calculus and options for mitigation can be quite different to external actors. An insider is anyone who has (or had) authorised access to your critical assets - people, information, technology or buildings. Former staff count too. Leaving is a common trigger.
Insider threat is the potential for that person to harm your organisation, deliberately or by accident. Insider risk is how likely that is and how bad it would be if it happened.
The Difference
An insider already has access. Firewalls and passwords are built to keep out people who don’t. Their activity often looks like normal work, because they are using access they were given.
Colleagues or managers see the warning signs - grievances, odd behaviour - before any system does. The response is HR and legal, and the person keeps their rights as an employee.
Seven Patterns
Insider cases fall into seven patterns:
- Theft of intellectual property - taking trade secrets or customer data, often when leaving for a competitor.
- IT sabotage - deliberately damaging systems and data.
- Fraud - changing or stealing data for money.
- Misuse of authorised access - using access you legitimately hold for a purpose it was not given for.
- Accidents - such as an email to the wrong person, or falling for a phishing message.
- Espionage - passing secrets to a foreign state.
- Workplace violence.
Investigators sort evidence into these seven patterns.
The Cases
In convicted cases, the most common pressure before an incident is being sacked, then resigning. The most common warning behaviour is going to work for a competitor.
Most data left by email, then removable media (USB sticks and such), then paper. The most common sabotage is changing critical data, then deleting it.
A 2017 survey by Carnegie Mellon’s Software Engineering Institute, the US Secret Service and CSO Magazine found that:
- 20% of electronic crime events were suspected or known to involve insiders.
- 30% of respondents thought insider damage was worse than outsider damage.
Risk
Each pattern is given a likelihood and an impact, then goes on the risk register. The organisation weighs it against its risk appetite - how much risk it has agreed to accept.
Not every insider can be stopped. The aim is to get the risk down to that level, and to keep critical work going during and after an incident.
Culture eats strategy for breakfast.
Privacy
Insider-risk work uses personal data - monitoring, case files, pre-hire screening - so bring your legal and privacy teams in when designing the programme. In the UK this means the UK GDPR and the Data Protection Act 2018. Data minimisation applies directly: collect only what you need.
What Next
The next piece covers critical assets: knowing what you are protecting.