A Critical Reflection on the Threat from Human Insiders – Its Nature, Industry Perceptions, and Detection Approaches

Abstract

Abstract. Organisations today operate in a world fraught with threats, including "script kiddies", hackers, hacktivists and advanced persistent threats. Although these threats can be harmful to an enterprise, a potentially more devastating and anecdotally more likely threat is that of the malicious insider. These trusted individuals have access to valuable company systems and data, and are well placed to undermine security measures and to attack their employers. In this paper, we engage in a critical reflection on the insider threat in order to better understand the nature of attacks, associated human factors, perceptions of threats, and detection approaches. We differentiate our work from other contributions by moving away from a purely academic perspective, and instead focus on distilling industrial reports (i.e., those that capture practitioners' experiences and feedback) and case studies in order to truly appreciate how insider attacks occur in practice and how viable preventative solutions may be developed.

2 Fast 2 Secure: A Case Study of Post-Breach Security Changes

“…The majority of the security controls were put in place as a knee-jerk reaction to the breach itself, and because of the fear of losing everything. For a business that makes profit from generating intellectual property, IP theft is a great concern [17]and likely to be caused by a disgruntled insider [17]. Such existential threats place cyber security at a level of priority for the board rather than remaining an 'IT concern' [19].…”

“…Company boards are increasingly being encouraged to become seriously involved with the security of their organization [25]. However, when it comes to insider attacks, many companies underestimate them and fail to report them when they occur [17]. Company A is on the other side of this spectrum though.…”

Insider threat response and recovery strategies in financial services firms

“…Insider threat has advanced to an issue of growing concern and significance, a fact also reflected in the soaring number of publications dedicated to the topic. 6 Contributions cover a wider range of different themes spanning from behavioural research to technical attack modelling. 7 10 Insider threat management denotes an emerging focus area of operational risk and information security management.…”

Adaptive One-Class Ensemble-based Anomaly Detection: An Application to Insider Threats

“…However, the absence of previously logged malicious insider threats, among the logs of normal users' behaviour in an organisation, shapes the insider threat detection mechanism into a one-class data mining approach, namely anomaly detection. The topic of insider threat detection is getting increased concern by organisations, as a result of the significant number of malicious insider threats reported in recent years [3]. These threats are attributed to insiders; current or former employees, contractors, or business partners in an organisation, who have privileged access to the network, system, and data.…”