An insider threat refers to the risk posed by employees or contractors who may misuse their authorized access to an organization’s assets. The National Institute of Standards and Technology (NIST) provides guidelines and standards for managing insider threats in both government and private sector organizations.
What is an insider threat?
An insider threat is a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors, or business associates. This type of threat can involve fraud, theft of confidential or commercially valuable information, misuse of information systems, or acts of workplace violence.
Some examples of insider threats include:
- Employees stealing confidential data to sell to competitors or foreign entities
- Disgruntled workers destroying data or sabotaging systems
- Privileged users like system administrators misusing access rights to snoop on sensitive information
- Careless or poorly trained insiders mishandling data and inadvertently exposing it to risks
Insider threats are especially dangerous because insiders have authorized access and intimate knowledge of an organization’s data, processes, and systems. This makes it easier for them to circumvent security measures and cover their tracks.
Types of insider threats
NIST categorizes insider threats into three types:
- The traitor – An insider who has become disgruntled with their employer and intentionally misuses their access to harm the organization. This includes malicious activities like theft, fraud, sabotage, espionage, or violence.
- The turncoat – Insiders who are recruited or manipulated by external parties to abuse their position. Turncoats may not initiate a threat, but are convinced to participate in activities they might otherwise avoid.
- The unwitting pawn – Insiders with authorized access who are manipulated into taking actions that aid an external threat actor or compromise the organization. They may not even realize their access is being misused.
Insider threat statistics
Some statistics that highlight the prevalence of insider threats:
- 58% of organizations feel vulnerable to insider attacks according to a survey by the Ponemon Institute and IBM.
- 90% of organizations feel vulnerable to insider threats according to research by Haystax.
- Malicious insider attacks increased by 47% between 2018 and 2020 based on a report by the Ponemon Institute.
- Accidental insider threats account for over 25% of all breaches according to the Verizon Data Breach Investigations Report.
- Over 50% of employees say they have access to company data they probably should not according to research by Egress.
These statistics demonstrate that insider threats are a significant concern faced by a majority of organizations today.
Why insider threats matter
Insider threats pose a major risk because:
- They bypass physical and network security controls since insiders already have trusted access.
- They have intimate knowledge of internal processes, data locations, and potential weaknesses.
- Early warning signs are often overlooked or misinterpreted.
- Damage done can involve loss of sensitive data, intellectual property, credibility, and customer trust.
- Insiders may have access to critical systems, infrastructure or facilities.
- Their actions can cause business disruption, financial costs, regulatory fines, lawsuits or other legal action.
Additionally, many organizations are increasing their use of digital systems, cloud services, remote access, and third party vendors. This expands the insider threat exposure.
For these reasons, managing insider risk has become a priority for security professionals and executives worldwide.
NIST guidelines on insider threat programs
NIST provides extensive guidance on building holistic insider threat programs in both the public and private sector. Some of their key recommendations include:
Get executive support
Successful insider threat programs require clear direction and resource support from senior leadership. Leadership must establish the vision, priorities, and budget for the program across departments.
Take a risk-based approach
Conduct risk assessments of potential insider threat scenarios, focused on critical assets and access. Tailor program activities to mitigate highest priority risks.
Develop a formal program
Document formal policies, plans, and procedures governing the insider threat program. Define program objectives, scope, stakeholders, governance, execution, and communications.
Utilize centralized cross-functional teams
Establish dedicated cross-functional program teams with representation from departments like security, legal, HR, IT, data privacy, and business units. Central points of contact should coordinate activities.
Leverage technology
Deploy solutions to collect, monitor, detect, and respond to anomalous or risky user behavior. For example, user activity monitoring, data loss prevention, access controls etc.
Establish processes
Define standardized processes and controls around employee lifecycle events like onboarding, offboarding, user provisioning/deprovisioning, employee screening and monitoring.
Train employees
Conduct security awareness training to educate employees on expected behaviors and inform them about insider threat policies and procedures.
Communicate internally
Promote awareness of insider threat risks, program activities, policies, and responsibilities across the organization.
Plan response and recovery
Develop Incident Response Plans (IRPs) covering insider threat scenarios that include steps for rapid detection, investigation, evidence gathering, containment, eradication and recovery.
NIST framework for insider threats
NIST outlines a comprehensive insider threat framework comprised of the following components:
Deter
Implement deterrence controls like security policies, user training, monitoring, and disciplinary actions.
Detect
Detect potential insider activities through technical controls like access logs, behavior monitoring, and attack sensing.
Disrupt
Disrupt malicious acts early through blocking of unauthorized activities and limiting insider access.
Analyze
Analyze suspicious user actions and anomalies to ascertain risk, intent, and impact.
Respond
Enable rapid and structured response by implementing insider threat Incident Response Plans.
Recover
Execute recovery controls to limit damage, restore operations, apply lessons learned and improve defenses.
This integrated defense model provides a systematic approach to address all stages of the insider threat lifecycle.
NIST Insider Threat Policy Templates
NIST has published customizable policy templates to aid organizations in implementing formal insider threat programs. These include:
- Executive Insider Threat Policy – Establishes leadership support and governance for the program.
- Insider Threat Program Plan – Defines the framework, objectives, and requirements for the program.
- Insider Threat Awareness Training Plan – Provides guidance on insider threat education.
- Incident Response Plan – Covers processes for handling potential insider threat incidents.
- Insider Threat Configuration Management Plan – Documents controls to safeguard program assets and configurations.
Organizations can easily tailor these templates to create a customized set of policies for their industry, risk profile and maturity level.
Key elements of an insider threat program
Based on NIST guidelines, the key elements of an effective insider threat program include:
- Asset protection – Identify critical assets (data, systems, facilities etc.) and address associated insider risks.
- Access management – Limit user access to only what is required and monitor privileged users.
- Workforce health – Detect troublesome behaviors through employee monitoring and provide care options.
- Incident handling – Develop and test Insider Threat Incident Response Plans.
- Awareness training – Educate the workforce on indicators, reporting and responsibilities.
- Data collection – Utilize monitoring controls to detect anomalous user activities.
- Analysis and response – Analyze suspicious behaviors to determine risk levels and guide responses.
- Program oversight – Manage the program via leadership, governance structures and configuration control.
A mature insider threat program will incorporate each of these elements based on an organization’s unique risk profile and requirements.
Insider threat mitigation strategies
Recommended mitigation strategies for insider threats include:
- Conducting comprehensive employee screening and background checks.
- Providing cybersecurity and privacy awareness training.
- Developing data classification, access, and usage policies.
- Monitoring user activity on systems and networks.
- Analyzing data access and privileged user behavior patterns.
- Disabling access immediately after staff departures.
- Enforcing separation of duties and least privilege access.
- Implementing data loss prevention controls.
- Securing endpoints, servers, credentials, and data repositories.
- Detecting, investigating, and responding rapidly to anomalous behaviors.
A defense-in-depth security strategy across people, processes and technology provides layered protection against malicious, compromised, or negligent insiders.
Benefits of an insider threat program
Properly implemented insider threat programs provide multifaceted protection and risk reduction benefits:
- Earlier detection of insider activities through improved monitoring and indicators.
- Enhanced ability to rapidly analyze and respond to incidents.
- Increased understanding of critical assets and associated risks.
- Improved protection for sensitive data, intellectual property, and core infrastructure.
- Reduced risk of fraud, theft, leaks, sabotage or attacks due to insider threats.
- Minimized business disruption, brand damage, financial impacts, and legal liability.
- Better alignment to industry regulations related to insider risk management.
Additionally, insider threat programs reinforce workplace ethics, enable supportive interventions, and demonstrate duty of care.
Challenges in addressing insider threats
Some key challenges faced by organizations in tackling insider threats include:
- Detection – Spotting anomalous behaviors among legitimate activities is difficult.
- Legal concerns – Privacy, labor laws, and civil liberties complicate monitoring.
- Underreporting – Insider threats often go unreported due to bystander apathy.
- Visibility gaps – Shadow IT, cloud apps, and remote access limit visibility.
- False positives – Distinguishing real threats from innocuous anomalies can be tricky.
- Negative culture – Excessive controls may breed mistrust and resentment.
- Business impacts – Stringent security can affect productivity and collaboration.
- Complexity – Integrating threat data across fragmented systems is difficult.
- Cost – Substantial investment required for controls and dedicated staff.
Organizations must carefully balance insider threat programs with user privacy, legal considerations, culture, and business objectives. Ongoing tuning of controls is also essential.
Insider threat standards and frameworks
Key standards and frameworks relevant to insider risk management include:
- NIST 800-53 – Provides recommended security controls including ones focused on insider threats.
- CERT Insider Threat Center – Research group that develops insider threat controls and best practices.
- CIS Critical Security Controls – Control 17 covers data protection which is relevant to insider threats.
- ISO 27001 – Requires controls to manage insider risks under the information security standard.
- COBIT 2019 – Details insider threat program governance guidelines under APO13.
- HIPAA – Requires safeguards against insider breaches under the Security Rule.
- GLBA – Mandates safeguards for financial data privacy subject to insider exposures.
- SOX – Seeks controls to prevent fraud including from potential insiders.
Adhering to these established standards and frameworks provides a strong foundation for holistic insider threat programs.
Insider threat tools
Technical tools that enable insider threat detection, analysis and response include:
- User Activity Monitoring – Records detailed user actions across network, systems, and applications.
- Database Activity Monitoring – Audits database access down to the query level.
- File Access Monitoring – Alerts on unauthorized attempts to access or exfiltrate sensitive files.
- Privileged Access Management – Monitors and controls admin users across IT infrastructure.
- Data Loss Prevention – Blocks unauthorized data exfiltration attempts across channels.
- Behavioral Analytics – Uses machine learning to model normal behavior and detect anomalies.
- Visualization and Threat Intelligence – Collects, correlates and visualizes activity indicators.
- Security Information and Event Management (SIEM) – Centralizes and analyzes log data to detect threats.
These capabilities automate the collection, correlation, detection, investigation, reporting and response processes required to combat insider threats.
Key takeaways
- Insider threats pose significant risk and are a top concern for most organizations.
- NIST provides extensive guidelines on insider threat programs spanning people, processes, and technology.
- An insider threat framework covers deterrence, detection, disruption, analysis, response and recovery.
- Insider threat programs deliver multifaceted risk reduction but have costs and challenges.
- A defense-in-depth approach is required with controls across the employee lifecycle.
- Standards like NIST 800-53 and ISO 27001 highlight insider risk safeguards.
- Specialized tools automate detection and response to malicious or unintentional insider activities.
By leveraging standards like NIST 800-53 and ISO 27001, organizations can develop robust insider threat programs integrated across people, processes, and technology. This reduces the risk, business impact, and legal exposure associated with insider threat incidents.
