How to Defend Against Different Insider Threats

TL;DR

Effective insider-threat defense starts with a threat model that identifies valuable assets, relevant adversaries, and the attack surfaces they can exploit. Organizations should distinguish accidental, opportunistic, and determined insiders, apply defenses suited to each actor’s motivation and behavior, and validate whether those security measures work as intended.

Transcript

Hi, my name is Ted Harrington, and I'm executive partner and one of the owners of Independent Security Evaluators. We're an information security consulting and research firm. And one of the things that we're gonna talk about today is the insider threat. Many organizations are cognizant of the fact that there is a very real and very dangerous threat... Read More

Key Insights

• A threat model is the objective that directs an organization’s security activities. Without a clearly understood, designed, and implemented model, individual security measures may be beneficial but may not move the organization toward defending its assets against the adversaries it actually faces.
• A complete threat model identifies the assets requiring protection, the adversaries interested in attacking those assets, and the architectural attack surfaces those adversaries could use. These elements connect defensive planning to realistic targets, actors, and possible paths of compromise.
• The internal threat includes trusted employees, partners, vendors, and other integrated third-party entities. Because harmful activity can originate from several kinds of trusted relationships, organizations should examine the full trusted environment rather than limiting attention to their own employees.
• An accidental insider is a trusted person who intends no harm but damages the organization through a mistake. Examples include clicking an inappropriate link, using a bad password, giving a password to another person, or improperly sharing a credential.
• An opportunistic insider is a person who compromises an asset when an attractive opportunity appears and no mechanism seems likely to identify them. Possible motivations described include selling the asset for financial gain or publishing it to obtain notoriety.
• A determined insider is deliberately motivated to harm the organization and includes disgruntled and malicious subgroups. A disgruntled insider changes after an event or disagreement, while a malicious insider enters the organization with harmful intent from the beginning.
• Different insider adversaries require different defense tactics because their motivations, objectives, operating methods, and skills differ. A control that addresses accidental behavior may not stop an opportunistic or determined actor, so organizations should avoid treating every insider threat identically.
• Effective validation is essential after a threat model and defensive measures have been implemented. Organizations can fail through poor design or poor implementation, making it necessary to select validation methodologies carefully and understand the realistic outcomes those methods can provide.

Questions & Answers

Q: What are the main types of insider threats?

The internal threat is primarily divided into three adversary types: accidental, opportunistic, and determined insiders. Accidental insiders cause harm without intending to do so. Opportunistic insiders exploit favorable situations when they believe they will not be identified. Determined insiders deliberately seek to harm the organization and can be further divided into disgruntled insiders and malicious insiders.

Q: What is a security threat model?

A security threat model is an organization’s defined defensive objective. It identifies the assets that need protection, the adversaries who may want to obtain or compromise those assets, and the architectural attack surfaces those adversaries could exploit. It helps ensure that security activities move toward a specific goal instead of merely producing general improvements without clear direction.

Q: Why should every organization create a threat model?

Every organization should create a threat model because security measures need a clear objective. The transcript compares this principle to training for a marathon: exercises can be beneficial without necessarily supporting the intended goal. A threat model focuses security work by connecting protected assets, relevant adversaries, and exploitable attack surfaces to the organization’s defensive plans.

Q: What is an accidental insider threat?

An accidental insider is a trusted entity who begins with good intentions and does not mean to damage the organization. Harm results from a mistake, such as clicking a link that should not have been clicked, using a bad password, giving a password to someone who should not receive it, or improperly sharing a credential.

Q: What is an opportunistic insider threat?

An opportunistic insider does not necessarily begin with an intention to harm the organization. The person acts when an opportunity to compromise an asset offers some benefit and no mechanism appears likely to trace the action back to them. The benefit might include selling the asset for financial gain or posting it online to receive notoriety.

Q: What is the difference between disgruntled and malicious insiders?

A disgruntled insider may once have been satisfied with the organization but later becomes determined to cause harm after something changes. Possible triggers include being overlooked for a promotion or disagreeing with an organizational political stance. A malicious insider differs because harmful motivation exists from the outset, and the person joins the organization specifically to enact harm.

Q: Why do insider threats require different defense tactics?

Insider threats require different defense tactics because accidental, opportunistic, disgruntled, and malicious actors have different motivations, objectives, operating methods, and skills. Not every defensive measure works against every category. Organizations therefore need to understand the distinctions among adversaries before choosing mechanisms intended to prevent, detect, or otherwise thwart their particular forms of harmful behavior.

Q: How should organizations validate insider-threat defenses?

Organizations should validate whether their implemented security measures effectively address the adversaries and attack paths identified in the threat model. Validation must examine both design and implementation because organizations can fail in either area. They should also understand the differences among validation methodologies and set realistic expectations about the outcomes each method can provide.

Summary & Key Takeaways

• Organizations should treat insider threats as several distinct adversary types rather than a single category. Trusted employees, partners, vendors, and integrated third parties can create danger in different ways. Understanding their intentions, operating methods, objectives, and skills is necessary for selecting security measures that address the actual threats facing the organization.

• A threat model gives security work a defined objective. It identifies the organization’s assets, the adversaries interested in obtaining or compromising those assets, and the architectural attack surfaces they could exploit. Without this direction, security activities may still be useful but may not move the organization toward its specific defensive goal.

• Insiders may cause harm accidentally, exploit an untraceable opportunity for personal benefit, or deliberately attack the organization. Determined insiders include disgruntled people whose attitudes changed and malicious people who joined with harmful intent. Organizations need tailored defenses for these adversaries and effective validation of both security design and implementation.