Manual home / Contents / Chapter 02
Chapter 02 · Foundations
The four types of insider threat
Written for anyone who has to sort incoming concerns into categories that lead to different responses.
Four categories, four different responses
Cases divide usefully into four categories. The value of the split is not taxonomic tidiness: each category has a different motive, leaves a different evidence trail, and is caught by a different control. A programme that treats them as one problem buys controls that address only one of them.
| Category | Typical motive | Typical evidence trail | Control that most often catches it |
|---|---|---|---|
| Sabotage | Grievance, retaliation, occasionally political or financial advantage | Privileged changes outside change control; deletion or disabling of backups and logging | Segregation of duties over destructive operations |
| Fraud | Direct personal gain | Small repeated transactions, altered reference data, self-approved records | Reconciliation and maker-checker approval |
| Intellectual property theft | Taking work to a competitor or a new venture | Bulk collection then bulk movement, clustered near a resignation | Egress review at the leaver point |
| Accidental threat | None — error, haste or misunderstanding | A single misaddressed or misconfigured action, usually self-reported | Interface design and a reporting route that is not punitive |
Sabotage
Sabotage is the deliberate destruction or degradation of something the organisation depends on. It is heavily concentrated among people with privileged technical access, because the damage a person can do is bounded by what they can reach, and it clusters around events the actor experiences as a grievance.
Two features make it distinctive. First, it is often prepared in advance of the trigger, so the preparation and the act can be separated by weeks. Second, it frequently attacks the recovery path before it attacks the primary system: backups, logging, alerting and out-of-band credentials. Treating recovery infrastructure as ordinary infrastructure, under the same single-administrator model as everything else, is the condition that makes serious sabotage possible.
Fraud
Fraud here means using access to obtain money or its equivalent. It differs from the other categories in tempo: it is usually a long series of small acts rather than a single large one, because the actor is trying to stay under a review threshold rather than to finish quickly.
Because the tempo is slow, detection is a reconciliation problem rather than an alerting problem. The question is not whether any single transaction looked wrong; it is whether two independent records of the same reality still agree. Where one person can both create a record and approve it, that question cannot be asked.
Intellectual property theft
This is the category most organisations actually encounter. It is rarely elaborate: material the person already works with daily is collected into one place and then moved out through a route that is ordinarily permitted. The distinguishing signal is almost never the route. It is the change in volume, and its position in time relative to the person's departure.
The material at issue is usually the material the person genuinely helped produce, which is why these cases are contested more often than the others and why the evidence handling described in chapter 7 matters more here than anywhere else.
Accidental threat
Accidental cases have no motive to find, and they are by a wide margin the most frequent. A file goes to the wrong recipient, a permission is set wider than intended, a device leaves a building. The exposure can be identical to a deliberate act; only the intent differs.
Note
The controlling variable in accidental exposure is how quickly it is reported, and that is set by how the last person to report one was treated. A programme that responds to error the way it responds to malice converts its cheapest category of incident into its slowest.