Insider Threat Research Group mark: a squared plate rule

INSIDER THREAT RESEARCH GROUP

The CISO Guide to Managing Insider Threats

Manual home / Contents / Chapter 05

Chapter 05 · Controls

Access and data controls

Written for IT and identity teams, and for security teams who need to explain why access design outranks detection.

Access is the control that does the work

Diagram of four access tiers: open working material, role-restricted material, restricted material requiring named approval, and destructive administrative operations requiring two people.
Figure 1 — Four tiers, each with a different granting rule. The tier boundary, not the monitoring, is what limits the size of an incident.

Detection tells you an incident is happening. Access design decides how large it can be. Of the two, only the second works while nobody is watching, and it is the only one that is equally effective against the deliberate and the accidental case.

Tier 0 — Open working material
Available to all staff. Nothing whose loss would matter belongs here, and the tier's purpose is to be large enough that people do not route around the others.
Tier 1 — Role-restricted
Granted by role, reviewed when the role changes. The bulk of an organisation's material.
Tier 2 — Restricted
Granted individually with a named approver and an expiry. Access is a decision with a date on it, not a property of a person.
Tier 3 — Destructive operations
Deletion, backup and log administration, key management. Two people, always, with no standing single-holder route.

Joiners, movers and leavers

The movers step is the one that is routinely skipped, and it is the step that creates the accumulated access that makes every later case worse. A person who has held four roles and kept the access from each is not a suspicious person; they are an unmanaged control.

  1. Joining: grant the role's standard access only. Anything additional follows the tier 2 route with an approver and an expiry.
  2. Moving: remove the previous role's access on the same working day the new role's access is granted. Treat the pair as one transaction that cannot be half-completed.
  3. Leaving: withdraw at the agreed departure time across every system in the inventory, including systems administered by suppliers.
  4. After leaving: confirm withdrawal against the inventory rather than against the ticket, and check the accounts that are not named after the person.

Note

Shared, service and break-glass accounts are where withdrawal quietly fails, because they are not attached to a name and so appear on nobody's leaver list. Inventory them separately and rotate their credentials on departure.

Segregation of duties

Segregation of duties means no single person can complete a damaging sequence alone. It is the control that most directly limits sabotage and fraud, and it is the one most often traded away for convenience in small teams.

  • Creating a record and approving it are different people.
  • Granting access and reviewing access grants are different people.
  • Administering a system and administering that system's logs are different people.
  • Deleting production data and holding the backup that brings it back are different people.

Where headcount genuinely does not allow separation, the honest answer is to record the exception, put a compensating detective control on the specific operation, and review it — not to declare the principle inapplicable.