That\u2019s the total average cost of insider threat-related incidents, according to the 2018 Cost of Insider Threats: Global Organizations<\/a> report from the Ponemon Institute and ObserveIT. Of course, these costs range significantly depending on which type of insider threat you\u2019re looking at \u2014 which we\u2019ll get into more momentarily. <\/p>\n\n\n\n The main point here is that even just one insider threat is\na major concern for every organization, government, and business that employs\npeople. Which, realistically, includes every business or organization in the\nworld that isn\u2019t a sole proprietorship. And it\u2019s a growing issue that many\ncompanies would prefer to keep under the rug \u2014 though, these threats sometimes\nbecome very public. <\/p>\n\n\n\n But what exactly is an insider threat and what does this\nterm entail? We\u2019ll evaluate what is an inside threat, consider a few insider\nthreat definitions, and even break down a few insider threat statistics and\nwhat they mean for your organization.<\/p>\n\n\n\n As we always like to say around here\u2026<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n KnowBe4 reports<\/a> that \u201c76% of organizations say the biggest and most persistent security threat comes from \u2018the enemy from within.\u2019\u201d But what constitutes such a threat?<\/p>\n\n\n\n Our insider threat definition is that it\u2019s a threat that originates from within your own organization. Essentially, it\u2019s someone who poses a security risk to your organization through their access. This is a broad category because it can include current and former employees, executives, contractors, interns, or anyone else who has authorized access to critical systems or information. Other companies and organizations vary a bit with the specifics of the description, but this is the overall general concept at its core. <\/p>\n\n\n\n \u00a0[\u2026] one or more individuals with the access or inside knowledge of a company, organization, or enterprise, that would allow them to exploit the vulnerabilities of that entity\u2019s security, systems, services, products, or facilities with the intent to cause harm.\u201d<\/em><\/p>\n \u2014 The President\u2019s National Infrastructure Advisory Council\u2019s Final Report and Recommendations on the Insider Threat to Critical Infrastructures April 2008 <\/cite><\/blockquote>\n\n\n\n It\u2019s important to note that the PNIAC\u2019s insider threat definition views insider threats in a broader sense in terms of it being related to terrorism, workplace violence, and\/or cyber security. For cyber security specifically<\/a>, it\u2019s about \u201cThe risks presented to an organization either by a malicious insider or by an insider who mishandles technology.\u201d <\/p>\n\n\n\n You\u2019re likely able to think of a good number of people\nwithin your own organization who qualify as potential cyber security insider threats\nbecause of their access to critical information systems \u2014 regardless of whether\nor not they\u2019d actually do something malicious. But how do you further break down\nthe insider threat category, though?<\/p>\n\n\n\n There are three main types of insider threats, according to\nthe Ponemon Institute\/ObserveIT insider threats report I mentioned earlier: <\/p>\n\n\n\n Verizon\u2019s 2019 Insider Threat Report<\/a> takes the categories and breaks them down further:<\/p>\n\n\n\n The Ponemon Institute identified the most common type of\ninsider threat as a negligent employee or contractor. This category of insider\nthreat represents 2,081 of the 3,269 incidents reported in the study! However,\nthey\u2019re not the most costly incidents incidents\u2014 that undesirable \u201chonor\u201d falls\non credential theft insider threats, which were both the least reported and the\nmost expensive. <\/p>\n\n\n\n\n\n While I can\u2019t speak for the people who commit these types of\ninsider cybercrimes \u2014 you know, because I\u2019m someone who prefers to help rather\nthan hinder others \u2014 I can at least share some of the known reasons why someone\nmay choose to become a criminal insider threat. It could be because they simply\nwant revenge \u2014 to get even for a perceived (or real) slight by a current or\nformer employer. Or, they may want money and either choose to hold information\nhostage (ransomware attack) or want to sell it on the dark web, to a third\nparty or to a competing business. <\/p>\n\n\n\n Other motivations for criminal insiders also can range from acts\nof corporate or nation state espionage to simple curiosity that gets out of\nhand. Or, maybe, it\u2019s pride and they want to show off. <\/p>\n\n\n\n Regardless of the rationale, the important takeaway is that insider threats are major concerns for all businesses and organizations \u2014 ones that need to be taken seriously. <\/p>\n\n\n\n Let\u2019s consider the following insider threat example<\/a>. Say I work in a position where I need access to customers\u2019 personal information to perform my daily work-related tasks. I work this position for a couple of years and then decide to take a new position within the same organization \u2014 a different role within another department. In my new job, I no longer require direct access to those customer records. However, my access privileges aren\u2019t revoked and I continue to have access to that sensitive data for the rest of the time that I\u2019m employed by that organization. Therefore, I pose as a potential information security and cyber security threat to my organization.<\/p>\n\n\n\n While I have absolutely no interest<\/em> in accessing or using that information, the same may not be said about someone else who may retain the same amount of access. What if they get passed over for a promotion or become disgruntled for another reason? They could choose to do the unthinkable and abuse their access to commit a crime. Or what if someone phishes me and gets a hold of my company login credentials? Now they have access to every system that I have privileges for, including the customer data that I shouldn\u2019t<\/em> still have access to in my role. <\/p>\n\n\n\n While this particular example is hypothetical (actually,\nit\u2019s based on my own real-life experience at a previous employer \u2014 minus me\nfalling for a phishing scam and my credentials becoming compromised \u2014 but let\u2019s\nleave it at that), there are plenty of real-life insider threat examples and\nsituations we can point to. Here are a handful of examples:<\/p>\n\n\n\n While these examples are now history, they still serve as\nvaluable reminders of what can happen when sensitive info is left available to\nthose who are either malicious or careless in their actions. <\/p>\n\n\n\nWhat Is an Insider Threat and Why Is It Such a Concern for Everyone?<\/h1>\n\n\n
![\"Graphic:](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/12\/employee-insider-threat2.jpg\")
<\/figure>\n<\/div>\n\n\n\n
Types of Insider Threats<\/h3>\n\n\n\n
\n
contractor<\/strong> (64%),<\/li>\n\n\n\n
<\/li>\n\n\n\n
or contractor\u2019s login information (13%).<\/li>\n<\/ul>\n\n\n\n\n
someone who misuses assets through resource appropriation, mishandling data,
installing unauthorized applications (shadow IT), breaking acceptable use
policies, etc. <\/li>\n\n\n\n
steals information to benefit one or more third parties through the
exfiltration of company data. <\/li>\n\n\n\n
is for someone who disrupts operations or destroys property or data to harm their
organization.<\/li>\n\n\n\n
who uses their access privilege to steal and use information for personal
gain.\u00a0 <\/li>\n\n\n\n
irresponsible third party, such as a business partner or a contractor, who
compromises an organization\u2019s security through malicious or negligent access or
assets or information. <\/li>\n<\/ol>\n\n\n\nMotives for Criminal Insider Threats<\/h3>\n\n\n\n
Insider Threat Examples<\/h2>\n\n\n\n
\n
The Running Costs of Insider Threats<\/h2>\n\n\n
![\"Graphic:](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/12\/insider-threat-costs.png\")
<\/figure>\n<\/div>\n\n\n