What are insider threats? what are the risks and mitigations associated with insider threats? 

Recently, global electric vehicle manufacturer Tesla sued its former employee for causing a data breach by altering their source code to exfiltrate massive amounts of its sensitive data to third parties.  

According to Tesla, not only did the employee breach Tesla’s Propriety Information Agreement but he also broke the present Nevada Computer Crimes Law.   

Upon investigation by experts, it was found that the employee was disgruntled because of an undisclosed role assigned to him, and he did all that as an act of retaliation against the company. Tesla learned a lesson on how harmful insider threats could be and how critical it is to take pre-emptive measures to ensure the mitigation of any possibilities of insider threats. 

Let us understand insider threats, the risks that they pose, and mitigation measures against insider threats. 

What are insider threats? 

An insider is any person with an understanding of an organization or with authorized access to an organization’s resources or both. It could be anyone associated with the organization, like an employee, a contractor, a vendor, or a partner.

Insider threat is a potential harm to an organization caused by an insider through: 

• Malicious/intentional use or (for example – stealing company data and selling it to a third party)
• Complacent/unintentional use of understanding/special access, permissions, etc. (for example – losing a company laptop/device containing sensitive information) 

The following are the possible motives behind an insider threat: 

• Financial gain  
• Resentment towards the organization or a specific person or people 
• Political/social/ideological/activism-related conflict 
• Coercion/Blackmail from third party 
• Complacency/laziness 

It can negatively impact an organization by affecting its: 

• Integrity and confidentiality of data 
• Access to data, people, facilities, and resources 

Common examples of insider threats include: 

• Making a financial transaction from the organization account to a third-party account  
• Sending an email containing sensitive information to the wrong address 
• Giving someone unauthorized access to the organization’s systems  

Some interesting facts about insider threats 

• 55% of insider incidents were due to employee negligence (Insider Threat Report 2023, Ponemon) 
• 74% of organizations believe that insider threats have become more frequent (Insider Threat Report 2024, Cybersecurity insiders) 
• 49% of data breaches in the EMEA region were due to internal threat actors (DBIR 2024, Verizon) 
• 90% of organizations reported that insider attacks are equally or more challenging to detect than external attacks (Insider Threat Report 2024, Cybersecurity Insiders) 
• 70% of healthcare attacks were orchestrated by internal threat actors (DBIR 2024, Verizon) 

What are the risks and mitigations associated with insider threats? 

What makes insider threat dangerous is that one cannot simply see it coming. And insider threats can be costly. As per the Ponemon Insider Threat Report 2023, insider threats can cost up to $16.2 million on average per organization to resolve.  

The following are some of the risks associated with insider threats: 

• Data loss, corruption, exposure, etc. – for example, theft and exposure of company secrets to third parties 
• Operational disruption – for example, hacking a company’s cloud storage and deleting operation-specific data 
• Financial damage – for example, loss from damage due to data loss/corruption  
• Reputational damage – for example, reduction in investors’ trust 

The following are some of the mitigation measures that can be implemented against insider threats: 

• Always perform background checks – ensure that periodical background checks are done for employees, vendors, contractors, and partners.  
• Prepare a detailed insider threat mitigation program – take the help of experts to frame a detailed insider threat mitigation program that covers the policies, processes, technology, access controls, and procedures to proactively identify and prevent insider threats.  
• Secure critical assets– Identify and take measures to ensure physical and digital security of assets that can be exposed to insider threats like company secrets, prototypes, etc.  
• Implement incident response measures – Plan and implement measures for incident response measures against insider threat attacks.  
• Ensure round-the-clock-security monitoring – continuously monitor the network activity of users across the organization for suspicious activities (like transfer of sensitive files and any signs of unauthorized access) while ensuring that it is in line with privacy regulations.   
• Identify and bridge security awareness gaps – regularly conduct awareness gap assessments across different levels of the organization to ensure that employees are aware of the security hygiene best practices to reduce the possibilities of unintentional insider threats.