Insider threat

The CERT National Insider Threat Center at Carnegie Mellon's Software Engineering Institute, whose case database has shaped most of the field, groups malicious insider cases into IT sabotage, theft of intellectual property, fraud and espionage, and treats unintentional insider threat as a separate category. The patterns differ. Sabotage is typically carried out by technically privileged staff such as administrators after a negative workplace event, often using backdoor accounts or logic bombs prepared before departure. IP theft clusters around resignation, with data typically taken within the weeks before and after notice. Fraud is usually committed by non-technical staff abusing authorised business functions, such as creating fictitious suppliers or altering payment details. Negligent insiders and insiders whose credentials are compromised by outside attackers are, by volume, far more common than malicious ones.

Preventive controls centre on limiting what trusted access can do. Least privilege and regular access reviews counter privilege creep; segregation of duties (ISO/IEC 27002:2022 control 5.3) and four-eyes approval stop one person completing a fraudulent transaction alone; privileged access management vaults admin credentials and records sessions; joiner-mover-leaver processes remove access on the day of departure, supported by 6.5 (responsibilities after termination) and 6.1 (screening). NIST SP 800-53 Rev. 5 requires an insider threat programme in control PM-12 and insider threat awareness training in AT-2(2).

Detection relies on behavioural baselines rather than signatures, because insiders use legitimate credentials. User and entity behaviour analytics, DLP and cloud access logs flag anomalies such as mass downloads, syncing to personal cloud storage, access outside normal working patterns or to data outside one's role. False positives are high and context is essential, so effective programmes combine technical signals with HR and management information, for example a pending resignation.

Monitoring employees is legally constrained. In Denmark, processing must comply with GDPR and the Data Protection Act, and Datatilsynet's guidance on employee monitoring stresses proportionality and transparency; for employers covered by the DA/LO agreement on control measures (kontrolaftalen), new control measures must normally be announced to employees at least six weeks in advance, with narrow exceptions. Blanket, covert surveillance is rarely lawful. Insider threat differs from external threat actors in that no perimeter is crossed and authentication succeeds, which is why perimeter defences and MFA do little against it, and it is the parent category of human error, which covers the accidental branch.