Insider Threat

Insider threats are as dangerous as external threats if not more dangerous security threats for the assets of an organization. Moreover, organizations should establish stringent security measures to handle security threats and risks that come from within the organization. Most organizations worry about cyberattacks from external actors such as hackers without paying much attention and establishing mitigation strategies to its employees.

An insider is any person or entity that has or had authorized formal access to or prior knowledge of an organizations’ assets, including its people (permanent employees, vendors and contractors), architectures, facilities, information and information systems, devices, network components, and systems or applications. Moreover, it is the threat that an insider will use his or her authorized access privilege, wittingly or unwittingly, to do harm to the organization’s mission, vision, resources, personnel, facilities, information, equipment, networks, or systems.

Insider threat is thus the possibility of former and current insiders to launch cyberattack to harm their former organization for various reasons such grudge, resentment, and demotion. These threat actors are extremely difficult to deal with, and may bring unimaginable havoc to an organization due to their insider knowledge and authorized access to resources. Moreover, these cyberattacks may emanate from malicious behavior, complacent, negligence, intentional or inadvertent actions that could negatively affect the confidentiality, integrity and availability objectives of the organization.

The security threats that the insiders will have on the organization may be manifested through the following nefarious behaviors.

• Unauthorized disclosure of information
• Corporate espionage
• Cyberterrorism
• Fraudulent transactions and corruption
• Sabotage
• Workplace protest
• Intentional or inadvertent loss or degradation of organizational assets or capabilities
• Theft