Page 25 - the SyI Quarterly 13 - (V4)

Our Membership
Organisational Resilience -
Insider Risk.
- By Keith Johnson MSyl
Description of insider risk
Insider risk is posed by individual(s) with access
or knowledge used to damage, deprive, diminish,
injure or interrupt organisations, including their
employees, stakeholders, assets, materials, critical
processes, information systems, intellectual
property, brand and reputation.
A common element of insider risks (or insider
attacks) is that the perpetrator(s) has or has
formerly had a trusted position and obtained
privileged access to potentially sensitive
information or essential equipment that is then
exploited with the intent to harm the facility, the
organisation, its operations or the environment.
Insider incidents have been trending upwards
during recent years, influenced by the growing
contractor and outsourced economies, remote
and hybrid workforces, and employees with
access to cloud-based applications lacking
sufficient security precautions. Each element
provides an opportunity for both accidental and
malicious insider security breaches.
What was intended to be achieved?
The perpetual occurrence of insider incidents
in both the public and private sectors led the
author to develop a research questionnaire
and undertake semi-structured interviews
to investigate how conventional insider risk
mitigations are applied and how effective they are
perceived to be. The author also explored how
the detection of insider threats can be actively
recognised or predicted, with the research aim to
suggest enhancements to existing insider threat
mitigation strategies.
24
What were the concerns, and what did the
research say?
An anonymous online questionnaire was
developed to assess the perception of insider
risk amongst security industry specialists who
were all members of an acclaimed security
institute with a stringent membership criterion
and a professional code of conduct.
The participants who volunteered to complete
the questionnaire had no prior knowledge of
the assessment questions, nor were they aware
of any analysis of their responses. The author
also developed and conducted semi-structured
primary research interviews with recognised
and professionally respected security industry
experts who shall also remain anonymous.
An interesting opinion highlighted in response to
the questionnaire was that it was perceived that
an accidental or unintentional incident caused by
an onboarded employee was more of a concern
than an external player seeking to commit a
hostile insider attack.
The author believes three main themes, activities,
and challenges are associated with addressing
insider risk.
The three themes are.
• The first theme consists of identifying
patterns and trends of insider crimes.
• The second theme is the methods and
motives used for insider activities.
• The third theme is the organisational
response and resilience against insider risks.
The three primary types of insider activity are
• The theft of information or assets for
personal advantage or personal financial
gain.
• The second activity is the theft of assets and
modification of information for commercial or
state advantage.
• Thirdly, the sabotage of assets or destruction
of information, including damage and
destruction of either physical or virtual
systems.
25