Insider threat
noun · NIST CSRC Glossary
Risk that comes from people with legitimate access, such as employees or contractors, whether they act maliciously, carelessly or under an attacker's control.
An insider already has what most attackers work hard to get: valid credentials and access to systems and data. Insider threats are usually grouped into three kinds:
- Malicious: someone who intentionally steals data, sabotages systems or helps an outside party, for money, revenge or ideology.
- Negligent: someone who causes harm by mistake, such as emailing a sensitive file to the wrong person or leaving a storage bucket open to the internet.
- Compromised: a legitimate user whose account or device is controlled by an external attacker, often without their knowledge.
Because the activity comes from a trusted account, it rarely looks like an attack at first.
Example
An engineer who has accepted a job at a competitor spends their last two weeks downloading design documents they have not opened in months and syncing them to a personal cloud storage account. Every action uses their own, legitimate permissions.
Why it matters for a SOC analyst
Detecting insiders depends on context about normal behavior: how much data a user usually accesses, which systems, and at what hours. User behavior analytics, data loss prevention and access reviews all help. Investigations involving employees are sensitive, so follow your organization's process and involve HR and legal before acting on suspicions about a person.
Related terms
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Identity and access management
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.
- Social engineering
Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.
- Role-based access control
Granting permissions to roles, such as Help Desk or Billing Reader, and then assigning people to roles, instead of granting rights person by person.