Insider Threat
Insider Threat examines people already inside the perimeter - employees, contractors, temporary labour, drivers, guards and third-party staff - who use legitimate access for illegitimate ends. The exam tests program design that is proportionate and legally defensible, not surveillance enthusiasm.
Who and why
- Insiders include current and former staff, agency labour, cleaners, maintenance engineers, security officers, drivers and 3PL personnel.
- Motives: financial pressure or greed, ideology, coercion or blackmail, disgruntlement and revenge, negligence and shortcut-taking.
- Insiders are effective because they know the controls, the blind spots and the paperwork shortcuts.
Behavioural and data indicators
- Access anomalies: logins outside shift patterns, bulk record lookups, badge events at unusual hours, repeated procedural overrides.
- Life signs a manager should notice and refer, not diagnose: sudden lifestyle change, refusal to take leave, escalating grievances, unusual interest in security arrangements.
- Refer concerns to HR and security through a defined route; do not investigate informally.
Program elements
- Pre-employment screening and re-screening for critical roles; continuous vetting where the role warrants it.
- Least privilege and segregation of duties: whoever books a pickup should not authorise release.
- Job rotation and mandatory leave break concealment schemes that need daily control.
- Monitoring of physical and logical activity under a documented, legally reviewed and proportionate policy.
- Confidential reporting line with a non-retaliation statement and visible follow-through.
- Investigation discipline: preserve evidence, maintain chain of custody, interview consistently, coordinate with legal and HR.
Worked example
A depot shows repeated short shipments on one shift, always within tolerance. Reasoning: tolerance abuse plus shift concentration points to an insider, not a carrier. Analysis of load plans, badge events, CCTV and seal logs shows one supervisor releasing trailers before counts are recorded. Response: evidence preserved, access revoked, HR and legal engaged, and the count process changed to two-person verification.
Traps
Profiling on demographics rather than behaviour and access; ignoring small tolerated losses that fund organised crime; covert monitoring with no policy or legal basis; no deprovisioning at termination; and assuming screening at hire is the whole program.