Tackling Insider Threats, from Cybersecurity's Perspective

By Rahul Guhathakurta

Cover Image Attribute: Image by Robinraj Premchand from Pixabay

One of the most significant unresolved problems in cybersecurity is the insider threat, which can come from a company's workers, contractors, and vendors. A recent investigation found that it was present in fifty percent of the reported data breaches. Companies are undoubtedly aware of the issue, but it is uncommon for them to commit the necessary resources or attention from top leadership to find a solution. Most preventative programs are unsuccessful either because they solely concentrate on monitoring participants' behaviors or because they ignore cultural and privacy standards.

A micro-segmentation strategy is currently being evaluated by many of the world's most successful organizations because of its ability to target possible issues more accurately. Others are embracing fundamental shifts in their cultures as well as predictive analytics. These innovative methods may produce more accurate results than the more conventional monitoring and surveillance methods. They may also assist businesses in navigating the complex interaction of protecting their assets while simultaneously honoring the rights of their employees.

Classification of Insider Threats

From a cybersecurity point of view, there are primarily two categories of insider threats: malicious users; those who purposefully cause harm to the institutions and unintentional insider users; those that accidentally expose confidential data.

At first, we need to determine the "damage spectrum"  within which an insider threat will generally operate. Note; such spectrum will vary from organization to organization. As an insider threat, they can cause damage in one of two ways: 

1) by staying within their default set of privileges, or 

2) by exceeding those privileges by seeking new information and capability through a repertoire that includes both conventional and unconventional attacks, such as social engineering. 

The challenge with assessing the dangers within the spectrum posed by insiders is precisely the problem of determining the extent of the damage that either of these two scenarios could potentially cause. 

Building a risk assessment framework

Identify, Protect, Detect, Respond, and Recover; are the five important functions outlined in the risk assessment framework and should be used to organize cybersecurity countermeasures. In addition, these functions are intended to provide the risk manager with assistance in evaluating, discussing, and defending against potential cyber threats originating from the inside.

But also note that the technology itself is an insufficient factor to be considered for assessing risks and the launch of full-fledged countermeasures. Gated approaches and controls can identify and thwart malicious behavior; nevertheless, we require further information to prevent users from acting without discrimination. 

Furthermore, human values tremendously impact how a person conducts themselves, and these values can occasionally reveal clues that help predict a person's future behavior. Therefore, analysis of people's feelings is becoming increasingly crucial in cutting-edge research methods. For example, the chances of isolating promiscuous behavior might increase significantly by monitoring and recognizing disgruntled employees.

How to Approach and Mitigate?

Step 1: Define What Needs to Be Protected. Kindly note, both classified and unclassified information are a critical part of insider threat program efforts.

Step 2: Identify and define the insider threats to the organization (based on Step 1). Then, map those threats with the organization's mission, culture, and critical assets, and develop a risk assessment framework that covers the holistic threat matrix.

Step 3: Define a threat reporting structure that establishes and reinforces a positive statement of an organization’s investment in its people's well-being, overall resilience, and operational effectiveness.

Step 4: Deploy a User Access Control (UAC) system. This data security method allows organizations to regulate the individuals permitted to access business resources and related data. The following access controls should be deployed for successful UAC adaptation (they can be layered or deployed as standalone mechanisms);

• Mandatory Access Control (MAC)
• Role-Based Access Control (RBAC)
• Discretionary Access Control (DAC)
• Rule-Based Access Control (RBAC or RB-RBAC)

Step 5: Deploy a real-time User Activity Monitoring (UAM) system at all network endpoints that hold or access critical security information. These technologies can detect, investigate, and interpret unusual behaviors within the IT and OPSEC environment. The following capabilities should be deployed for successful UAM adaptation;

• Keystroke monitoring
• The capture of full application content (e.g., email, chat, data import, data export)
• Screen capture
• File shadowing for all lawful purposes
• Ability to set triggers/alerts based on user activity

Step 6: Deploy robust training and certification programs for Key Users and End Users. And it should be done on a continual basis.

Step 7: Last but not the least, adopt a resilient decision-making system duly linked with a threat reporting structure (as defined in Step 2). This system should be based upon the facts presented in the reporting and investigative process, as well as the culture and tolerance for risk in an organization.

About the Author:

Rahul Guhathakurta (ORCID: 0000-0002-6400-6423) is a strategic management consultant. A primary investor in IndraStra Global — a Wyoming-based publishing company.

IndraStra Global is now available on
Apple News, Google News, Flipboard, Feedburner, and Telegram

COPYRIGHT: This article is published under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. https://creativecommons.org/licenses/by-nc-nd/4.0/

REPUBLISH: Republish our articles online or in print for free if you follow these guidelines. https://www.indrastra.com/p/republish-us.html