Insider Threat
Jaivardhan Singh
Data Protection | Cloud Security | Insider Threat | Enterprise DLP | Microsoft Purview | AIP | CASB
Characterizing Insiders Threats
CERT’s “Common Sense Guide to Mitigating Insider Threats,” defines an insider as a current or former employee, contractor, or business partner who meets the following criteria:
? Has or had authorized access to an organization’s network, system, or data
? Has intentionally exceeded or intentionally used that access in a manner that
negatively affected the confidentiality, integrity, or availability of the organization’s
information or information systems
Insider threat occurs in three varieties, of decreasing frequency:
1. Careless or uninformed users who unintentionally violate security requirements and
policies due to a lack of cybersecurity awareness, training, or foundational cyberhygiene.
2. Negligent users who intentionally evade security measure out of convenience,
neglect, or misguided attempts to increase productivity.
3. Malicious users who intentionally evade security measures in attempts to profit
financially, gain revenge, or seek to unmask corruption or other malfeasance, based
on a misguided sense of idealism