Lessons · Cybersecurity · insider risk
Insider risk: the threat with a badge
An insider risk is harm done by somebody who already has legitimate access, whether on purpose, by mistake, or because their account was taken over.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The sales manager gave notice on Monday. On Wednesday night his account exported the whole customer list. No firewall saw anything wrong, because he was allowed to read it. What catches this is watching for the unusual, not for the forbidden.
How to think about it
Three kinds, three controls. Malicious: least privilege and an alert on bulk access. Careless: training and safe defaults. Compromised: MFA and alerts on logins from new places. Then a leaver process that removes access on the last day, not the next Monday.
Worked example
Log: user rgreen exported 40,000 customer records at 23:40Allowed, and abnormal. Allowed is not the same as fine.
Context: resignation on file, last day FridayThe notice period is watched more closely, by written policy, not by suspicion.
Control: alert on any export over 1,000 recordsA threshold is a rule, so it runs every time and nobody has to decide.
Kind: careless, malicious or compromised, decided from the evidenceThe same line could be a stolen password. Containment starts the same either way.
Your turn
The process that removes a person's access on the day they leave. Write the word for that kind of process.
the process
Solve one, graded on the server
The trap
Picturing only the malicious insider. The tired administrator who deletes the wrong volume at 6 p.m. is an insider risk too, and least privilege protects against them as well.