Insider Threats

An insider threat is a security risk that originates from within the organization. The insider is a person who has or had authorized access to the organization's network, systems, or data. According to the CERT Division of Carnegie Mellon University, insider threats are classified into three categories: malicious insiders, negligent insiders, and accidental insiders. The SY0-701 exam focuses on recognizing these categories and the appropriate mitigations.

#### Malicious Insiders A malicious insider intentionally harms the organization. Common motivations include financial gain, revenge, ideology, or coercion. For example, a disgruntled employee who is about to be terminated might exfiltrate sensitive customer data to sell to a competitor. Malicious insiders often have deep knowledge of security controls and can cover their tracks.

#### Negligent Insiders Negligent insiders cause harm unintentionally through carelessness or failure to follow security policies. Examples include falling for a phishing email, leaving a laptop unlocked in a public place, or misconfiguring a cloud storage bucket. According to the 2023 Verizon Data Breach Investigations Report, 74% of breaches involved the human element, including negligence.

#### Accidental Insiders Accidental insiders cause harm through mistakes without negligence. For instance, an employee might accidentally send an email containing sensitive data to the wrong recipient. Unlike negligent insiders, accidental insiders are typically following procedures but make an honest error.

Insider threats often follow a pattern similar to external attacks but with distinct phases:

#### User and Entity Behavior Analytics (UEBA)

UEBA tools establish a baseline of normal user behavior and flag anomalies. For example, if a user who normally accesses 10 files per day suddenly downloads 10,000 files at 3 AM, UEBA generates an alert. UEBA uses machine learning to detect deviations in:

#### Data Loss Prevention (DLP)

DLP systems monitor and control data transfers to prevent unauthorized exfiltration. They can be network-based (monitoring email, HTTP, FTP) or endpoint-based (monitoring USB drives, printing). DLP policies can block or alert on:

#### Privileged Access Management (PAM)

PAM solutions control and monitor accounts with elevated privileges. Key features include:

#### Least Privilege and Separation of Duties

Least privilege ensures users have only the permissions necessary for their job. Separation of duties prevents any single person from having conflicting responsibilities, such as both creating a vendor account and approving payments.

Security professionals use various tools to detect insider threats:

- SIEM (Security Information and Event Management): Aggregates logs from multiple sources. Example query to detect abnormal file access:

index=windows sourcetype=WinEventLog:Security EventCode=4663 Object_Type=File
  | stats count by Account_Name, Object_Name
  | where count > 100

- Sysmon: Logs process creation, network connections, and file changes. Example configuration to monitor file deletion:

<EventFiltering>
    <RuleGroup name="FileDelete">
      <FileDelete onmatch="include">
        <TargetFilename condition="contains">*.xlsx</TargetFilename>
      </FileDelete>
    </RuleGroup>
  </EventFiltering>

- PowerShell logging: Enables transcription of PowerShell commands. To enable script block logging:

Set-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging -Name EnableScriptBlockLogging -Value 1

A system administrator at a financial services firm is leaving for a competitor. Over his final two weeks, he uses his legitimate admin credentials to access a file share containing client portfolios. He copies files to a USB drive and then deletes the local copies. The DLP system logs the USB write event and the file deletion events. The SIEM correlates the unusual file access pattern (accessing 500 files in one hour vs. normal 10) and triggers an alert. The analyst reviews the logs, sees the user is in the notice period, and escalates to HR. The common mistake: assuming the user's activity is normal because they have admin rights. The correct response is to disable the USB port via endpoint DLP policy and restrict the user's access to read-only during notice periods.

A healthcare employee accidentally emails a spreadsheet containing patient names, SSNs, and diagnoses to the wrong external recipient. The DLP system scans outbound emails and detects the presence of SSNs (pattern matching). It blocks the email and sends an alert. The analyst reviews the incident, sees it was a typo in the email address, and confirms no data left the organization. The mistake: not having a DLP policy that blocks such emails automatically. The analyst then works with the employee to add a confirmation dialog before sending emails with sensitive data.

A database administrator at a retail company queries the customer database to extract credit card numbers for personal use. He uses his own SQL client, which is not monitored. The UEBA system detects that his database queries are returning unusually large result sets (10,000 rows vs. normal 50). The alert is triggered, but the analyst initially dismisses it because the DBA has legitimate access. The mistake: failing to investigate because the user is trusted. The correct response is to review the query logs (if available) or implement a database activity monitoring (DAM) solution that captures all SQL statements. In this case, the DBA's queries were not logged, so the organization had no evidence. The lesson is to implement comprehensive logging for all privileged accounts.