What is an insider threat?
- Term
- Insider threat
- Meaning
- An insider threat is the chance that someone who has or had authorized access uses it, on purpose or by mistake, to harm the organization. Former staff count.
An insider threat is the chance that a person with inside access to an organization uses that access to harm it. The federal Cybersecurity and Infrastructure Security Agency (CISA) defines an insider threat as “the potential for an insider to use their authorized access or understanding of an organization to harm that organization.” A second definition on the same page, written for CISA itself, says the insider may act “wittingly or unwittingly,” so mistakes count as well as deliberate acts.
Who counts as an insider?
CISA defines an insider as “any person who has or had authorized access to or knowledge of an organization’s resources.” CISA lists those resources as personnel, facilities, information, equipment, networks and systems.
CISA’s examples are broad. They include a person the organization trusts, someone given a badge or access device, and a contractor, vendor, custodian or repair person. They also include anyone the organization has given a computer or network access.
The words “or had” mean a person stays inside the definition after they leave. A former employee, or a vendor whose contract has ended, is still an insider.
What types does CISA name?
CISA sorts insider threats by intent.
- Unintentional, in two forms. Negligence is exposing the organization through carelessness, such as losing a portable storage device or ignoring security patch reminders. Accidents are mistakes that create a risk nobody meant to cause, such as a mistyped email address that sends a sensitive document to a competitor.
- Intentional, also called malicious: harming the organization for personal benefit or over a personal grievance.
- Collusive: one or more insiders working with an outside attacker.
- Third-party: contractors or vendors who aren’t formal members of the organization.
What does the harm look like?
CISA lists five forms. Violence covers threats and threatening behavior. Espionage is covert spying. Sabotage is deliberate harm to physical or digital systems, and CISA’s examples include deleting code so that normal work stops. Theft covers money and intellectual property. Cyber covers theft, espionage, violence and sabotage carried out through technology.
Why the definition points to accounts
Every part of the definition runs through access, and on networks and systems, access comes through accounts. The Common Sense Guide to Mitigating Insider Threats, from Carnegie Mellon’s CERT National Insider Threat Center, turns this into account controls. They are covered in account controls in US insider threat guidance. When an insider’s use of a computer becomes a federal crime is covered in what is unauthorized access under the CFAA?
Frequently asked questions
Do former employees count as insiders?
Yes. CISA defines an insider as any person who "has or had" authorized access to or knowledge of an organization's resources, so leaving doesn't take someone out of the definition.
Is a careless employee an insider threat?
Yes. CISA counts unintentional threats, both negligence, such as ignoring known security rules, and accidents, such as mistyping an email address and sending a sensitive document to a competitor.
Are contractors and vendors insiders?
They can be. CISA's examples of insiders include contractors, vendors, custodians and repair people, and it names a third-party type for people who aren't formal members of the organization.
How Junify handles this
- Doing this by hand
- To avoid the same kind of incident, you stop every login a person could use each time they leave or a contract ends. You change the shared passwords they knew and send the new ones to everyone who stays. And someone has to check the sign-in records on a regular schedule.
- With Junify
- CISA's definition rests on access, and on a shared login that access is a password several people know. With Junify, the admin decides who may open each account. People verify on their own phone before Junify fills in the login, and they never see the password. Each use is recorded by person. When someone leaves, the admin removes their access in Junify, and they have no password to keep.
Sources
- CISA: Defining Insider Threats
- SEI CERT National Insider Threat Center, Common Sense Guide to Mitigating Insider Threats, Seventh Edition (2022)
-
A vendor's stolen login opened a retailer's network (2013) and what it shows about vendor remote access
A Senate staff report says attackers stole a contractor's login through infected email and used it to enter a national retailer's network.
-
Vendor call-center staff opened 68,701 customer accounts without authorization (2014) and what it shows about reviewing vendor access
For 168 days, three workers at a carrier's call-center vendor opened 68,701 customer accounts without authorization and collected personal details.
-
A former contractor used a shared cloud admin key (2018) and what it shows about shared admin logins
An online education company shared one full-access cloud key with staff and contractors. A former contractor used it to take data on about 40 million users.