Insider Threat Research Group mark: a squared plate rule

INSIDER THREAT RESEARCH GROUP

The CISO Guide to Managing Insider Threats

Manual home / Contents / Chapter 07

Chapter 07 · Response

Responding to a suspected insider incident

Written for whoever takes the first call, and for the people who will be asked what was done and when.

The order matters more than the speed

Sequence diagram of five response stages: report received, triage against the threshold, evidence preservation, containment decision, and outcome route.
Figure 2 — The response sequence. Containment follows preservation; reversing the two destroys the record that justifies the containment.

The instinct on a suspected insider case is to cut access immediately. That instinct is usually wrong for the first hour, because disabling an account frequently clears session records, triggers automated cleanups and tells the person that they are the subject of an enquiry — in that order, and before anything has been preserved.

Procedure: first response

  1. Record the report as received: what was observed, by whom, when, and what has already been done about it. Do not paraphrase the reporter.
  2. Apply the written threshold from chapter 4. If it is not met, record the decision and stop. Stopping is a legitimate outcome and should be a common one.
  3. Obtain authorisation from the named function before examining any individual's activity.
  4. Preserve before you touch: relevant logs, mailbox and file records, device state. Preserve copies, work from the copies, and record who held each one and when.
  5. Establish whether the activity has a legitimate explanation, which frequently requires the line manager's context. Ask for the context without naming the enquiry where that is possible.
  6. Decide containment on the evidence: restrict rather than disable where restriction stops the loss, and disable where it does not.
  7. Hand over to the appropriate route — control change, discussion, formal employment process, or referral — with the record intact.
  8. Close with a written outcome, including where the case was closed with no action.

Evidence handling

Insider cases end in employment processes far more often than in courtrooms, and employment processes still fail on evidence. The requirements are unglamorous and consistent.

  • Work from copies; leave originals untouched and recorded.
  • Keep a continuous record of who held each item, from preservation to conclusion.
  • Record times with a stated timezone, and reconcile timestamps between systems before drawing conclusions about sequence.
  • Separate the observation from the inference in every written note, so the two are never read back as one statement.
  • Retain the material that does not support the concern with the same care as the material that does.

Afterwards

The last step is the one most often dropped. Every closed case, including the ones closed with no action, should produce one written answer to a single question: which control would have made this smaller? If the answer is repeatedly "more monitoring", the programme has stopped reading its own cases.