{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/insider-threat","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/insider-threat/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/insider-threat/"},"term":{"en":"Insider threat","da":"Insidertrussel"},"aka":{"en":["insider risk"],"da":["insiderrisiko"]},"domain":["security"],"cluster":"fundamentals","layer":"people","status":"current","summary":{"en":"Harm that comes from someone already trusted inside the organisation, whether they mean to do damage or simply make a mistake.","da":"Skade, der kommer fra en person, som allerede er betroet inde i organisationen - enten med vilje eller ved en fejl."},"body":{"formal":{"en":"The risk that an employee, contractor or partner uses the access they were rightly given to harm the organisation's data or systems, either on purpose (theft, sabotage) or through carelessness (a wrong recipient, a lost laptop).","da":"Risikoen for, at en medarbejder, konsulent eller samarbejdspartner bruger den adgang, de har fået til deres arbejde, til at skade organisationens data eller systemer - enten med vilje (tyveri, sabotage) eller af skødesløshed (forkert modtager, en glemt bærbar)."},"plain":{"en":"Like a shop where the biggest losses come not from burglars but from staff - a few who slip goods into their bag, and many more who simply forget to lock up.","da":"Som en butik, hvor de største tab ikke skyldes indbrudstyve, men personalet - nogle få, der putter varer i tasken, og mange flere, der bare glemmer at låse af."},"inPractice":{"en":"A sales manager at a Danish engineering firm who has accepted a job with a competitor copies the full customer list to a private cloud folder in his last week, using the same access he had every day.","da":"En sælger i en dansk ingeniørvirksomhed, der har sagt ja til et job hos en konkurrent, kopierer hele kundelisten til en privat cloudmappe i sin sidste uge - med den samme adgang, han havde hver dag."},"whyItMatters":{"en":"Walls, firewalls and logins do little against someone already let in, so only limited access, watching for unusual use and a healthy culture keep the damage small.","da":"Mure, firewalls og login hjælper kun lidt mod en, der allerede er lukket ind; kun begrænset adgang, overvågning af usædvanlig brug og en sund kultur holder skaden nede."}},"deepDive":{"en":"The CERT National Insider Threat Center at Carnegie Mellon's Software Engineering Institute, whose case database has shaped most of the field, groups malicious insider cases into IT sabotage, theft of intellectual property, fraud and espionage, and treats unintentional insider threat as a separate category. The patterns differ. Sabotage is typically carried out by technically privileged staff such as administrators after a negative workplace event, often using backdoor accounts or logic bombs prepared before departure. IP theft clusters around resignation, with data typically taken within the weeks before and after notice. Fraud is usually committed by non-technical staff abusing authorised business functions, such as creating fictitious suppliers or altering payment details. Negligent insiders and insiders whose credentials are compromised by outside attackers are, by volume, far more common than malicious ones.\n\nPreventive controls centre on limiting what trusted access can do. Least privilege and regular access reviews counter privilege creep; segregation of duties (ISO/IEC 27002:2022 control 5.3) and four-eyes approval stop one person completing a fraudulent transaction alone; privileged access management vaults admin credentials and records sessions; joiner-mover-leaver processes remove access on the day of departure, supported by 6.5 (responsibilities after termination) and 6.1 (screening). NIST SP 800-53 Rev. 5 requires an insider threat programme in control PM-12 and insider threat awareness training in AT-2(2).\n\nDetection relies on behavioural baselines rather than signatures, because insiders use legitimate credentials. User and entity behaviour analytics, DLP and cloud access logs flag anomalies such as mass downloads, syncing to personal cloud storage, access outside normal working patterns or to data outside one's role. False positives are high and context is essential, so effective programmes combine technical signals with HR and management information, for example a pending resignation.\n\nMonitoring employees is legally constrained. In Denmark, processing must comply with GDPR and the Data Protection Act, and Datatilsynet's guidance on employee monitoring stresses proportionality and transparency; for employers covered by the DA/LO agreement on control measures (kontrolaftalen), new control measures must normally be announced to employees at least six weeks in advance, with narrow exceptions. Blanket, covert surveillance is rarely lawful. Insider threat differs from external threat actors in that no perimeter is crossed and authentication succeeds, which is why perimeter defences and MFA do little against it, and it is the parent category of human error, which covers the accidental branch.","da":"CERT National Insider Threat Center ved Carnegie Mellons Software Engineering Institute, hvis sagsdatabase har præget det meste af feltet, inddeler sager med ondsindede insidere i IT-sabotage, tyveri af intellektuel ejendom, svig og spionage og behandler utilsigtede insidertrusler som en særskilt kategori. Mønstrene er forskellige. Sabotage udføres typisk af teknisk privilegerede medarbejdere som administratorer efter en negativ hændelse på arbejdspladsen, ofte via bagdørskonti eller logiske bomber, der er forberedt inden fratrædelsen. Tyveri af intellektuel ejendom samler sig omkring opsigelsen, hvor data typisk tages i ugerne før og efter. Svig begås som regel af ikke-tekniske medarbejdere, der misbruger autoriserede forretningsfunktioner, fx ved at oprette fiktive leverandører eller ændre betalingsoplysninger. Skødesløse insidere og insidere, hvis loginoplysninger er kompromitteret af eksterne angribere, er i antal langt mere almindelige end ondsindede.\n\nForebyggende kontroller handler om at begrænse, hvad betroet adgang kan bruges til. Mindste privilegium og regelmæssige gennemgange af rettigheder modvirker, at rettigheder hober sig op; funktionsadskillelse (ISO/IEC 27002:2022 kontrol 5.3) og firøjneprincip forhindrer, at én person alene gennemfører en svigagtig transaktion; privileged access management opbevarer administratorkonti i en vault og optager sessioner; og processer for ansættelse, rolleskift og fratrædelse fjerner adgangen på fratrædelsesdagen, understøttet af 6.5 (ansvar efter ansættelsens ophør) og 6.1 (screening). NIST SP 800-53 Rev. 5 kræver et insidertrusselprogram i kontrol PM-12 og awareness-træning om insidertrusler i AT-2(2).\n\nDetektion bygger på adfærdsbaselines frem for signaturer, fordi insidere bruger legitime loginoplysninger. User and entity behaviour analytics (UEBA), DLP og adgangslogs fra cloudtjenester markerer afvigelser som massedownloads, synkronisering til private cloudmapper, adgang uden for de normale arbejdsmønstre eller til data uden for ens rolle. Andelen af falske positiver er høj, og konteksten er afgørende, så effektive programmer kombinerer tekniske signaler med oplysninger fra HR og ledelse, fx en verserende opsigelse.\n\nOvervågning af medarbejdere er juridisk begrænset. I Danmark skal behandlingen overholde GDPR og databeskyttelsesloven, og Datatilsynets vejledning om kontrol af medarbejdere lægger vægt på proportionalitet og gennemsigtighed; for arbejdsgivere, der er omfattet af DA/LO-aftalen om kontrolforanstaltninger (kontrolaftalen), skal nye kontrolforanstaltninger normalt varsles over for medarbejderne mindst seks uger i forvejen, med snævre undtagelser. Generel, skjult overvågning er sjældent lovlig. Insidertrusler adskiller sig fra eksterne trusselsaktører ved, at ingen perimeter krydses, og autentificeringen lykkes, og derfor hjælper perimeterforsvar og MFA kun lidt; de er overkategorien for menneskelige fejl, der dækker den utilsigtede gren."},"edges":[{"type":"requires","to":"security/threat-actor","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"exploits","to":"cs/permission","why":{"en":"An insider needs no break-in; they misuse the access rights they were given for their job.","da":"En insider behøver ikke bryde ind; de misbruger de rettigheder, de har fået til deres arbejde."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"Both a careless and a harmful insider can expose personal or business data to people who should never see it.","da":"Både en skødesløs og en ondsindet insider kan udsætte person- eller forretningsdata for folk, der aldrig burde se dem."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST Glossary - Insider Threat","url":"https://csrc.nist.gov/glossary/term/insider_threat","tier":"standard","publisher":"NIST"},{"title":"Datatilsynet - Kontrol af medarbejdere (vejledning, november 2023)","url":"https://www.datatilsynet.dk/Media/638348919997326341/Kontrol%20af%20medarbejdere.pdf","tier":"official-doc","publisher":"Datatilsynet"}],"draft":true}