Handling and Responding to Insider Threats
Types of insider
- Negligent - well-meaning but careless: misfiled data, weak passwords, phishing victims. Usually handled with training and controls, not disciplinary action.
- Malicious - deliberate theft, sabotage or fraud.
- Compromised - an outsider using a legitimate user's credentials; behaviourally it looks like an insider.
- Collusive - one or more insiders colluding with an external party.
Question writers exploit the negligent/malicious distinction constantly. Choosing a punitive response for a negligent user is a wrong answer.
Indicators and controls
Behavioural and technical signals: access at unusual hours, mass file access or download, data staging/archiving, printing spikes, unauthorised USB or cloud-storage uploads, privilege escalation attempts, requests for access outside role, unusual VPN geography, work during leave, and activity clustered around resignation or a performance dispute. Controls: DLP, UEBA, SIEM correlation, least privilege and periodic access reviews, separation of duties, honeytokens/canary files, egress monitoring, and CASB for shadow SaaS.
Response - the part that is not technical
The response must be coordinated with HR and legal from the start. Preserve evidence covertly and with authorisation: do not tip off the suspect, do not confront them yourself, do not seize a personal device without legal authority, and observe privacy and employment law and works-council agreements. Mirror or preserve mailbox and file activity, capture access logs, and maintain chain of custody because insider cases are the most likely to end in litigation or dismissal proceedings. Restrict access only at the moment of the planned action, in coordination with HR.
Traps: treating an insider case as purely an IT problem; disabling the account early and destroying the chance to observe wider collusion; ignoring that a compromised credential mimics malicious insider behaviour (check impossible travel, MFA fatigue, new device enrolment before accusing the employee).
Rule of thumb: if the case could end in dismissal, litigation or prosecution, the investigation plan is written by legal and executed by IT.