Definition & Types of Insider Threats in Cyber Security

Jun 27, 2021 / Kron

Data breaches caused by insider threats are one of the most significant problems encountered by companies in the process of the ongoing digital transformation process of the business world. Violations resulting from various vulnerabilities in data security and cyber security systems, or conscious/unconscious human errors make it significantly more difficult to protect companies’ critical data stacks in particular. Hence, you need to fully configure in-house access management.

Cyber Security Threats

There are many different threats that companies encounter in the field of cybersecurity. Ransomware, malware, social engineering studies, and phishing are among the main threats to data security. Breaches and human-induced errors that occur during remote access are also significant data breach types.

One of the most notable security problems is insider threats. Insider threats, which are a serious problem in terms of data and access security for many different sectors, can be defined as security risks arising from within the company. In other words, insider threats can also be expressed as cyber security problems that arise when people who have access to company critical data deliberately or unintentionally abuse these powers.

The source of the insider threat does not have to be a professional currently working at your company. While you may experience data breaches from your current employees, former employees, business partners, board members, and professionals who provide consulting services can also constitute an insider threat. For this very reason, regardless of whether you are in active corporate communication or not, it is recommended that you keep the data limits and access methods accessible to all professionals affiliated with your company under control with measures consisting of several different steps.

Insider Threats and Their Types

A person who has direct access to your company data, other than your employees or people with whom you have a professional relationship, is also considered an insider threat. The suppliers and vendors that you are in contact during your regular business activities also have a place among the important sources of insider threats.

Insider threats are divided into different groups in terms of motivation, awareness, level of access, and intention. IBM and the Ponemon Institute, define insider threats using the concepts of negligent, criminal, and phishing attacks. Gartner, on the other hand, prefers to classify insider threats under four different groups: pawns, goofs, collaborators, and lone wolves. It should be noted that the Ponemon Institute and Gartner are independent organizations and they submit their reports on different fields to government institutions.

Pawns

The pawns include company employees who are unwittingly manipulated to engage in malicious activities that could lead to a data breach. By downloading malware, pawns can damage your company's data security, as well as reveal credentials as a result of phishing and social engineering attacks. Both methods build the groundwork for the relationship between the cyber attacker and the pawns. Pawns generally stand out in the category of insider threats in the IT and finance sector.

Goofs

Goofs are a significant insider threat and think they are exempt from in-company data security policies. The main reason why this group, also referred to as ignorant or arrogant, is an insider threat is that they try to avoid security protocols due to their incompetence or because the security measures are not convenient. Hence, in-company data becomes vulnerable and open to attack. Due to hardware deficiencies, this group is mostly encountered in the public domain.

Collaborators

Employees who cooperate with your company's competitors or foreign states to commit cybercrime are called collaborators. Collaborators often use their privileged in-company access to steal intellectual property and customer information. Moreover, they cause deliberate interruptions in company operations for the benefit of the company/state with which they are partnered with or for their own personal gain. Collaborators are frequently found in the financial sector.

Lone Wolves

Lone wolves can be quite dangerous, particularly if they are people with high access privileges such as network or database administrators. Lone wolves exhibit malicious behavior without needing to be manipulated and will act for direct financial gain. This group is mostly associated with the health sector, as they are also willing to sell personal health data.

Insider Threat Indicators

Indicators of insider threats you may observe in your company can be classified as digital or behavioral.

Digital Indicators

Significant data downloads and data access
Access to sensitive data outside of job description
Access to data outside of the usual behavior profiles
Multiple requests for access to resources outside of in-company tasks
Using unauthorized storage devices
Network Browse
Data packing
Email sensitive data to a noncorporate network

Behavioral Indicators

Attempts to avoid security protocols
Frequent office stays past regular working hours
Negative behavior towards colleagues
Violation of corporate policies
Discussions about resignation and new job opportunities

For instance, it may constitute an insider threat if an employee is trying to obtain administrative approval to access unauthorized data, or is attempting to stow data that he/she has access to or is e-mailing it to a non-corporate network.

As a matter of fact, according to the "Cost of Insider Threats: Global Report 2020" report published by IBM Security, the frequency of data breaches caused by insider threats has tripled since 2016. Furthermore, the average cost of breaches caused by insider threats increased from $493,093 to $871,686 in 2019.

Research conducted on 964 IT department employees at 204 different companies asserts that 2962 of the 4716 violations reported were due to negligence or unwitting action. Again, the same research indicates that 1105 violations were directly caused by malicious data breach attempts, while identity information was stolen in 649 incidents. Another significant data point in the report is that the identity information of users with privileged access was stolen in 191 incidents.

The report states that 63% of insider threat breaches are caused by negligence, 23% is caused by intentional malicious attempts by company employees, and 14% is caused by the manipulation and theft of users' identity information.

When it comes to sensitive data and cybersecurity applications, you need to identify insider and external threats by conducting a threat analysis within your company. As the research by IBM demonstrates, supervising, controlling, and managing authorized accounts is essential for companies. Privileged Access Management (PAM) applications like our Single Connect solution play a significant role in reducing insider threats. Single Connect’s Authorized Session Manager will allow you to record authorized sessions and generate report logs, while it’s Dynamic Password Manager withe password safe feature can eliminate password sharing among employees. The Multi-Factor Authentication (MFA) component includes a geo-location feature and generates one-time passwords, helping you eliminate insider threats.

Single Connect, our Privileged Access Management (PAM) solution was included in the Magic Quadrant for Privileged Access Management report prepared by Gartner, proving that it is one of the prominent Privileged Access Management systems in the world.

In our next article, we will discuss how you can take precautions against insider threats by using our Privileged Access Management (PAM) solution, which provides end-to-end data security, reducing insider threats with high-level security.

Contact us to learn more about Single Connect or find more information about cybersecurity on the Kron Blog, regularly updated with current content.