Corporate leaders understandably spend a lot of time and money keeping their organizations safe from outside attacks. But the threat of an insider with special access and knowledge, especially one acting maliciously, could pose an even bigger risk. Author and cybersecurity consultant Jessica Barker explores some of the motives behind malicious insider attacks.
When it comes to information and cybersecurity, the specter of malicious insiders looms large. While external threats often dominate the headlines, many business leaders and risk professionals try not to think about malicious insiders but shudder when they do. Malicious insiders pose a unique threat when it comes to risk, compliance and information security within organizations. While most internal information and cybersecurity issues stem from unintentional errors within systems ill-equipped to support employees, those with malicious intent present a unique risk due to their privileged access to critical networks, systems and data.
These individuals, armed with privileged access and insider knowledge, can wreak havoc on organizations, causing financial losses, reputational damage and regulatory scrutiny. The stress, upset and cultural impact of malicious insiders should not be underestimated.
What motivates malicious insiders?
Malicious insiders operate with various motivations, ranging from financial gain to personal grievances or ideological misalignment. At the heart of some insider threats is the simple motive of financial gain. Individuals may exploit their access to sensitive company data for personal profit, such as selling trade secrets to competitors, committing fraud or taking sensitive information and using it in a new business venture of their own.
The offer of a new job can tempt a previously loyal employee to turn on their employer, particularly if they feel undervalued at their current place of work. This was a theme of the infamous Formula 1 Spygate, in which Nigel Stepney stole 780 pages of confidential information from Ferrari, handing it to Mike Coughlan, then chief designer at McLaren, seemingly with a view that the two could use the information as a springboard to secure new jobs at another F1 team.
But financial motivation and ambition were apparently not the only driving factors for Stepney’s actions. Having risen through the ranks of auto racing, Stepney was chief mechanic at Ferrari when driver Michael Schumacher was at the height of success in the early 2000s. Recognized as pivotal in the team’s achievements, it seems that Stepney was sorely disappointed when he did not get the promotion he felt he deserved.
This is a common factor in malicious insider activity, as I explore in my new book, “Hacked: The Secrets Behind Cyber Attacks.” Those who feel undervalued, overlooked or aggrieved justify their malicious activity against their employer. The desire for retribution, fueled by a sense of injustice or the belief in restoring balance, can compel an employee who was previously devoted to their organization to rationalize their wrongdoings as warranted retaliation. This perception of rectifying perceived injustice or leveling perceived imbalances in power dynamics can lead individuals to justify their actions as necessary forms of restitution.
Planning on Using AI for Security Compliance? Are You Sure You Don’t Just Need Automation?
Neither AI nor automation should be deployed without human oversight
Read moreMotivations can go beyond money & recognition
In some cases, insiders find motivation in their personal convictions or allegiances, which may conflict with the ethos or conduct of their employer, as was claimed by Edward Snowden. When Snowden leaked highly classified information from the National Security Agency (NSA), he said he had become gradually disillusioned with the programs he was involved in and frustrated that his ethical concerns were ignored. He has said that this is what prompted him to reveal thousands of classified NSA documents to journalists.
Individuals who are motivated by ideology may feel compelled to divulge sensitive information to media outlets, advocacy groups or foreign entities, driven by a desire to shed light on perceived ethical transgressions or to champion a specific agenda they deem worthy of advancement. This internal conflict between personal principles and organizational values can lead insiders to take action they perceive as aligning with their moral compass, even if it means breaching trust or confidentiality.
In some cases, malicious insiders are not organic to organizations but are rather strategically placed. Corporate or state-sponsored espionage entails the infiltration of insiders who clandestinely gather intelligence on behalf of external entities. These individuals, incentivized by espionage, are frequently enlisted, manipulated or induced by outside actors aiming to secure a competitive edge or enhance national security interests.
We must also not forget that there are times when insiders are not acting out of personal volition but rather due to coercion or manipulation. Threats to personal safety, blackmail or manipulation tactics can compel individuals to engage in illicit activities against their employers. These insiders find themselves in precarious situations, feeling coerced into actions they would not otherwise undertake.
Corporate- or state-sponsored espionage involves insiders spying on behalf of third parties, seeking to gain competitive advantages or national security advantages. These insiders may be recruited, coerced or bribed, highlighting the complex nature of insider threats.
Neutralizing insider threats requires multi-pronged approach
Mitigating the risks posed by malicious insiders requires a multifaceted approach that combines proactive measures and a robust security posture. Thorough screening of potential hires, regular checks on existing employees and adherence to the principle of least privilege are fundamental steps in bolstering defenses against insider threats. Implementing robust monitoring tools and anomaly detection systems can aid in early detection and response to suspicious behavior patterns.
Moreover, fostering a culture of information and cybersecurity awareness and vigilance is crucial. By empowering employees to adopt sound security practices and fostering a positive work environment, organizations can mitigate the likelihood of malicious insider threats. Addressing sources of discontent through fair treatment, transparent communication and opportunities for professional growth can help cultivate a resilient organizational culture that is less vulnerable to malicious insider threats.
By understanding the diverse motivations, tactics and mitigation strategies related to insider threats, we can more effectively safeguard our organizations’ assets and integrity. Cultivating a culture of cybersecurity awareness and resilience is essential in fortifying defenses and mitigating the risks posed by malicious insiders. With a proactive approach, healthy culture and a commitment to vigilance, organizations can navigate the complex landscape of malicious insider threats and protect their interests against adversaries that may exist — or develop — within the perimeter.
Jessica Barker, MBE, is the author of “Hacked: The Secrets Behind Cyber Attacks” and co-founder and co-CEO of Cygenta, a security consultancy. She also holds a Ph.D. in civil design from the University of Liverpool.
