Insider Threat

HighIdentity & AccessA01:2021 – Broken Access Control

Current or former employees, contractors, or business partners misuse their authorized access to steal data, sabotage systems, or facilitate external attacks against the organisation.

Immediate Response

1Revoke the insider's access to all systems and data immediately.
2Preserve forensic evidence: access logs, file activity, and communication records.
3Engage legal counsel and HR to ensure proper handling of the situation.
4Assess the scope of data accessed or systems modified.

All playbooks

1Conduct a thorough access review for all users with elevated privileges.
2Implement data loss prevention (DLP) controls for sensitive data channels.
3Enable user behavior analytics to detect anomalous access patterns.
4Review and enforce offboarding procedures for departing employees.

Long-term Prevention

1Implement least privilege access with regular access certification reviews.
2Deploy UEBA (User and Entity Behavior Analytics) for continuous monitoring.
3Establish a security culture program that encourages reporting of concerns.
4Conduct periodic insider threat risk assessments and tabletop exercises.

Attack vectors

Authorized users exfiltrating sensitive data through legitimate access channels
Disgruntled employees deleting or modifying critical systems and data
Compromised insider credentials used by external threat actors
Negligent insiders bypassing security controls for convenience

Indicators of compromise

Unusual data access patterns: bulk downloads, access outside business hours
Employees accessing data unrelated to their role or current projects
Data transfers to personal cloud storage, USB devices, or external email
Resigning employees accessing sensitive systems shortly before departure

Tooling

Microsoft Purview DLPForcepoint DLPSplunk UEBAVaronisProofpoint Insider Threat