What is an insider threat?
Explore how to defend your organization from insider activity, including users with authorized access who can willfully or unintentionally cause a data security incident.
Insider threat defined
Before insiders become a threat, they are a risk, which is defined as the potential for a person to use authorized access to the organization’s assets—either maliciously or unintentionally—in a way that negatively affects the organization. Access includes both physical and virtual access, and assets include information, processes, systems, and facilities.
What is an insider?
An insider is a trusted individual who has been given access to, or has knowledge of, any company resources, data, or system that’s not generally available to the public, including:
- People who have a badge or other device that allows them to continuously access the company’s physical property, such as a data center or corporate headquarters.
- People who have a company computer with network access.
- People who have access to a company’s corporate network, cloud resources, applications, or data.
- People who have knowledge about a company’s strategy and knowledge of their financials.
- People who build the company’s products or services.
Types of insider threats
Insider risks are trickier to detect than external threats because insiders already have access to an organization’s assets and are familiar with its security measures. Knowing the types of insider risks helps organizations better protect valuable assets.
-
Accident
Sometimes people make mistakes that may lead to potential security incidents. For example, a business partner sends a document with customer data to a colleague, not realizing they aren’t authorized to view that information. Or an employee responds to a phishing campaign and inadvertently installs malware.
-
Malicious
In a malicious security incident caused by an insider, an employee or a trusted person intentionally does something that they know will negatively affect the company. Such individuals may be motivated by personal grievances or other personal reasons and may be seeking financial or personal gain through their actions.
-
Negligence
Negligence is similar to an accident in that the person didn’t intend to cause a data security incident. The difference is that they may knowingly break a security policy. A common example is when an employee allows someone to enter a building without showing a badge. A digital equivalent would be overriding a security policy without careful consideration for the sake of speed and convenience or signing into company resources over an unsecured wireless connection.
-
Collusion
Some insider security incidents are the result of a trusted person collaborating with a cybercriminal organization to commit espionage or theft. This is another type of malicious insider risk.
How do malicious insider incidents occur?
Malicious incidents caused by insiders can occur in a variety of ways beyond a typical cyberattack. Here are some common ways that insiders may cause security incidents:
-
Violence
Insiders may use violence or the threat of violence to intimidate other employees or express discontent at an organization. Violence can take the form of verbal abuse, sexual harassment, bullying, assault, or other threatening actions.
-
Espionage
Espionage refers to the practice of stealing trade secrets, confidential information, or intellectual property belonging to an organization for the purpose of providing an advantage to a competitor or another party. For example, an organization may be infiltrated by a malicious insider who gathers financial information or product blueprints to gain a competitive advantage in the marketplace.
-
Sabotage
An insider may be dissatisfied with an organization and feel motivated to harm the organization’s physical property, data, or digital systems. Sabotage can occur in a variety of ways such as vandalizing equipment or compromising confidential information.
-
Fraud
Insiders may commit fraudulent activities for personal gain. For instance, a malicious insider may use a company’s credit card for personal use or submit false or inflated expense claims.
-
Theft
Insiders may steal an organization’s assets, sensitive data, or intellectual property for personal gain. For instance, a departing employee who is motivated by personal gain may exfiltrate confidential information for their future employer, or a contractor who is hired by an organization to perform specific tasks may steal sensitive data for their own benefits.
-
Seven insider risk indicators
Both humans and technology play a role in detecting insider risks. The key is to establish a baseline for what’s normal so that it’s easier to identify unusual activities.
-
User activity changes
Coworkers, managers, and partners may be in the best position to know if someone has become a risk to the organization. For example, a risky insider who is motivated to cause a data security incident may have sudden observable attitude changes as an unusual sign.
-
Anomalous data exfiltration
Employees often access and share confidential data at work. However, when a user suddenly shares or downloads an unusual volume of sensitive data compared to their past activities or peers in a similar role, it could indicate a potential data security incident.
-
A sequence of related risky activities
A single user action, such as downloading confidential data, might not be a potential risk on its own, but a series of actions could indicate potential data security risks. For example, suppose a user renamed confidential files to appear less sensitive, downloaded them from cloud storage, saved them on a portable device, and deleted them from cloud storage. In this case, it could suggest that the user was potentially trying to exfiltrate sensitive data while evading detection.
-
Departing employee data exfiltration
Data exfiltration often rises alongside resignations and can be either intentional or unintentional. An unintentional incident might look like a departing employee inadvertently copying sensitive data to keep a record of their accomplishments in their role, while a malicious incident could look like knowingly downloading sensitive data for personal gain or to assist them in their next position. When resignation events coincide with other unusual activities, it might indicate a data security incident.
-
Abnormal system access
Potential insider risks may start with users accessing resources that they don’t usually need for their job. For example, users who normally only access marketing-related systems suddenly start accessing finance systems multiple times a day.
-
Intimidation and harassment
One of the early signs of insider risks could be a user expressing threatening, harassing, or discriminatory communication. It not only causes harm to a company’s culture, but could also lead to other potential incidents.
-
Privileges escalation
Organizations usually protect and govern valuable resources by assigning privileged access and roles to limited personnel. If an employee tries to escalate their privileges without a clear business justification, it could be a sign of potential insider risk.
-
Examples of insider threats
Insider threat incidents such as data theft, espionage, or sabotage have happened in organizations of all sizes over the years. A few examples are:
- Stealing trade secrets and selling them to another company.
- Hacking into a company’s cloud infrastructure and deleting thousands of customer accounts.
- Using trade secrets to start a new company.
Importance of holistic insider risk management
A holistic insider risk management program that prioritizes employee-employer relationships and integrates privacy controls may reduce the number of potential insider security incidents and lead to faster detection. A recent study conducted by Microsoft found that companies with a holistic insider risk management program were 33 percent more likely to have fast detection of insider risk, and 16 percent more likely to have fast remediation than companies with a more fragmented approach.1
How to protect against insider threats
Organizations can address insider risk in a holistic way by focusing on processes, people, tools, and education. Use the following best practices to develop an insider risk management program that builds trust with employees and helps strengthen your security:
-
Prioritize employee trust and privacy
Building trust among employees begins with prioritizing their privacy. To foster a sense of comfort with their insider risk management program, consider implementing a multilevel approval process for initiating insider investigations. Additionally, it’s important to audit the activities of those conducting investigations to ensure they don’t overstep their boundaries. Implementing role-based access controls to limit who within the security team can access investigation data can also help maintain privacy. Anonymizing usernames during investigations can further protect employees’ privacy. Finally, consider deleting user flags after a set period of time if an investigation doesn’t proceed.
-
Use positive deterrents
While many insider risk programs rely on negative deterrents, such as policies and tools that restrict risky employee activities, it’s crucial to balance these measures with a preemptive approach. Positive deterrents, such as employee morale events, thorough onboarding, ongoing data security training and education, upward feedback, and work-life balance programs can help mitigate the likelihood of insider events. By engaging with employees in a productive and proactive way, positive deterrents address the source of risk and promote a culture of security within the organization.
-
Attain company-wide buy-in
IT and security teams may bear the primary responsibility for managing insider risk, but it’s essential to engage the entire company in this effort. Departments such as human resources, compliance, and legal play a critical role in defining policies, communicating with stakeholders, and making decisions during an investigation. To develop a more comprehensive and effective insider risk management program, organizations should seek buy-in and involvement from all areas of the company.
-
Use integrated and comprehensive security solutions
Effectively protecting your organization from insider risks requires more than just implementing the best security tools; it demands integrated solutions that provide enterprise-wide visibility and protection. When data security, identity and access management, extended detection and response (XDR), and security information and event management (SIEM) solutions are integrated, security teams can efficiently detect and prevent insider incidents.
-
Implement effective training
Employees play a crucial role in preventing security incidents, making them the first line of defense. Securing your company’s assets requires gaining employee buy-in, which in turn enhances the organization’s overall security. One of the most effective methods for creating this buy-in is through employee education. By educating employees, you can reduce the number of inadvertent insider events. It’s important to explain how insider events can impact both the company and its employees. Additionally, it’s crucial to communicate data protection policies and teach employees how to avoid potentially leaking data.
-
Use machine learning and AI
Security risks in today’s modern workplace are dynamic with various, constantly changing factors that can make them difficult to detect and respond to. However, by using machine learning and AI, organizations can detect and mitigate insider risks at machine speed, enabling adaptive and people-centric security. This advanced technology helps organizations understand how users interact with data, calculate and assign risk levels, and automatically tailor appropriate security controls. With these tools, organizations can streamline the process of identifying potential risks and prioritize their limited resources on addressing high-risk insider activities. This saves security teams valuable time while ensuring better data security.
Insider risk management solutions
Defending against insider threats can be challenging, as it's natural to trust those who work for and with the organization. Quickly identifying the most critical insider risks and prioritizing resources to investigate and mitigate them is crucial to reducing the impact of potential incidents and breaches. Fortunately, many cybersecurity tools that prevent external threats can also identify insider threats.
Microsoft Purview offers information protection, insider risk management, and data loss prevention (DLP) capabilities to help you gain visibility into data, detect critical insider risks that may lead to potential data security incidents, and prevent data loss effectively.
Microsoft Entra ID helps you manage who can access what and can alert you if someone’s sign-in and access activity is risky.
Microsoft Defender 365 is an XDR solution that helps you secure your clouds, apps, endpoints, and email from unauthorized activities. Governmental organizations like the Cybersecurity and Infrastructure Security Agency also provide guidance for developing an insider threat management program.
By adopting these tools and using expert guidance, organizations can better manage insider risks and protect their critical assets.
Learn more about Microsoft Security
Microsoft Purview
Get governance, protection, and compliance solutions for your organization’s data.
Microsoft Purview Insider Risk Management
Detect and mitigate insider risks with ready-to-use machine learning models.
Adaptive Protection in Microsoft Purview
Secure data with an intelligent and people-centric approach.
Building a holistic insider risk management program
Learn about five elements that help companies have stronger data security while protecting user trust.
Microsoft Purview Data Loss Prevention
Prevent unauthorized sharing, transferring, or use of data across apps, devices, and on-premises environments.
Microsoft Purview Communications Compliance
Meet regulatory compliance obligations and address potential business conduct violations.
Microsoft threat protection
Protect devices, apps, emails, identities, data, and cloud workloads with unified threat protection.
Microsoft Entra ID
Protect access to resources and data using strong authentication and risk-based adaptive access policies.
Frequently asked questions
-
There are four types of insider threats. An accidental insider threat is the risk that someone who works for or with a company makes a mistake that potentially compromises the organization or its data or people. A negligent insider risk is when someone knowingly breaks a security policy but doesn’t mean to cause harm. A malicious threat is when someone intentionally steals data, sabotages the organization, or behaves violently. Another form of a malicious threat is collusion, which is when an insider collaborates with someone outside the organization to cause harm.
-
Insider risk management is important because these types of incidents can do a great deal of damage to an organization and its people. With the right policies and solutions in place, organizations can get ahead of potential insider threats and protect the organization’s valuable assets.
-
There are several possible signs of an insider risk, including sudden changes in user activities, a connected sequence of risky activities, trying to access resources not needed for their job, attempting to escalate privileges, anomalous data exfiltration, departing employees exfiltrating data, and intimidation or harassment.
-
Preventing insider events can be tricky because risky activities that may lead to security incidents are performed by trusted people who have relationships at the organization and authorized access. A holistic insider risk management program that prioritizes employee-employer relationships and integrates privacy controls may reduce the number of insider security incidents and lead to faster detection. In addition to privacy controls and a focus on worker morale, regular training, company-wide buy-in, and integrated security tools can help reduce your risk.
-
A malicious insider threat is the possibility that a trusted person will deliberately harm the organization and the people who work there. This is distinct from unintentional insider risks that occur when someone accidentally compromises the company or breaks a security rule but doesn’t mean the company any harm.
Follow Microsoft