Redefining insider threats: a distinction between insider hazards and insider threats

Abstract

This article suggests a new definition of insiders and insider threats. It refrains from applying a harmoriented perspective that concentrates on the insider's intention to cause harm because it defines the insider threat either too narrow or too broad. Instead, a privilege-oriented perspective is applied that focuses on the insider's intention to misuse his privileged access to or knowledge about the organizational assets. Because existing privilege-oriented definitions refrain from making an explicit and clear-cut division between intentional and unintentional misuse of privilege, a new conceptualization is suggested that distinguishes insider hazards from insider threats. If the insider unintentionally misuses his insider privilege, it concerns an insider hazard. If the insider intentionally misuses his insider privilege, it is regarded as an insider threat.

Insider threats among Dutch SMEs: Nature and extent of incidents, and cyber security measures

“…Therefore, to mitigate the consequences of incidents, it may be more useful to distinguish between selfish (i.e., malicious, and negligent) and altruistic (i.e., well-meaning) incidents as opposed to the distinction currently made in the literature between intentional and unintentional incidents (e.g., CERT National Insider Threat Center, 2019;Cummings et al, 2012). Selfish insiders would fit into what Reveraert and Sauer (2021) call insider threats, the actors lacking trustworthiness who are aware and competent but unwilling to comply with the norm. Altruistic insiders would constitute insider dangers, the actors lacking proficiency who make honest mistakes, are unaware of the norm, or simply incompetent.…”