Missing The Insider Threat

I trust everyone. It is the devil inside that I do not trust is a great line from the movie "The Italian Job." Every single person has the potential to do harm if the right circumstances occur. Yes, this includes employees.
"I trust everyone. It is the devil inside that I do not trust" is a great line from the movie "The Italian Job." Every single person has the potential to do harm if the right circumstances occur. Yes, this includes employees.Why is it that once a total stranger is hired at your company, you now completely trust that person? Just because he or she is now called an employee does not mean that person has loyalty to your organization and would do nothing to hurt the company.

Many organizations don't perform any background checks or reference checks, and as long as the hiring manager likes them, they will hire them. Many people might not be who you think they are; not properly validating them can be an expensive, if not a fatal, mistake.

Because most organizations hire complete strangers and then give them access to sensitive data, all organizations must worry about the insider threat. Too much paranoia can cripple an organization, but the right amount can protect it. Just ask yourself a couple of simple questions:

  • If someone were fired from a previous company for stealing or unethical activity, would you know?

  • If someone were currently stealing or perform stealthy activity against your organization today, how would you know?

    When an organization posts a job opening, it can take weeks until the first interview occurs. All a competitor has to do is prep someone to ace the interview and then they are in. The fact that it can be this easy to get on the inside is a pretty scary thought.

    Once that competitor insider is hired by the company, the competitor organization has the potential to steal sensitive organizational data. Think about it: This is the same process that foreign governments use to plant a spy in a U.S. agency. Foreign governments know that a key criterion for that person is passing the polygraph, so they will put that person through intensive training so that he or she can do so with no problem.

    This points out organizations' key disadvantage. The attacker knows what process you are going to follow to hire someone, and all they have to do is prep someone so they ace that part of the process. Because these attacks are being perpetrated by trusted insiders, you need to understand the damage they can cause, how to build proper measures to prevent the attack, how to minimize the damage, and, at a minimum, how to detect the attacks in a timely manner.

    Many of the measures companies deploy today are ineffective against the insider. When companies talk about security and securing their enterprise, they are concerned with the external attack, forgetting about the damage that an insider can cause.

    Since everyone uses different terminology, it is important to define what we mean by "insider threat." The easiest way to get a base definition is to break the two words apart. According to, insider is defined as "one who has special knowledge or access to confidential information" and threat is defined as "an expression of an intention to inflict pain, injury, evil, or punishment; an indication of impending danger or harm; or one that is regarded as a possible danger." Putting this together, an insider threat is anyone who has special access or knowledge with the intent to cause harm or danger.

    Though no one wants to admit it, it is worth looking around your organization to see whether there are any insiders who are causing harm to the success of your organization.

    Dr. Eric Cole, Ph.D., is a security expert with more than 15 years of hands-on experience. Cole has experience in information technology with a focus on perimeter defense, secure network design, vulnerability discovery, penetration testing, and intrusion detection systems. He is the author of several books, including Hackers Beware, Hiding in Plain Site, Network Security Bible, and Insider Threat. He is the inventor of more than 20 patents, and is a researcher, writer, and speaker. Cole is a member of the Commission on Cyber Security for the 44th President and several executive advisory boards, and is CTO of the Americas for McAfee. Cole is involved with the SANS Technology Institute (STI) and SANS working with students, teaching, and maintaining and developing courseware. He is a SANS fellow, instructor, and course author.

  • Editors' Choice
    Jai Vijayan, Contributing Writer, Dark Reading
    Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading