The Problem With Insider Threat Investigations

When a potential insider threat incident occurs, stakeholders in your organization want to know three things: why did the incident happen, how did it happen, and how much damage did it cause?

It’s then up to you to fill in all of the details.

But there are a few big issues:

1. On average, not all insider threat incidents are detected in a timely manner (or at all)
2. When an insider threat has been detected, it is difficult to determine intent
3. The investigation itself often requires extensive use of internal resources
4. Shareable evidence of an incident is often difficult to come by

All you know is that in this situation you and your team need to detect the root cause of the potential insider threat incident before the problem gets worse. Then, you’ll need to have a plan to make sure that it won’t happen again.

It’s a seemingly unwinnable scenario traditionally full of stress, anguish, and long hours. We’re here to tell you that this doesn’t have to be the case!

Let’s run through a simulation of an insider threat investigation to explore how…

WHY ARE INSIDER THREAT INVESTIGATIONS SO TOUGH?

In the beginning, there was the big bang an inciting insider threat incident.

This “catalyzing” incident could have been brought to your attention in a variety of ways: anonymously via a colleague, the result of a technical breakdown or performance issue, or a triggered activity alert for a potential breach in policy. The important thing is that an out-of-policy or “odd” activity by a trusted insider was recognized, allowing you to perform an investigation into the potential insider threat incident.

That’s the problem with insider threat investigations. In many cases, they can’t start because the incidents themselves aren’t detected (or detected quickly enough to prevent extensive damage)!

1. VISIBILITY

   The truth is, insider threat investigations are usually so tough because there is a lack of evidence-based visibility into user activity.

   Knowing precisely what a trusted employee or contractor was up to, what happened, whether it was repeated, and determining their intent is crucial. Without the right people, policies, and technology in place (a holistic approach to insider threats), it is near impossible to get this visibility, and protect your organization’s valuable systems and data.

   Insider threat management tools are a great way to gain visibility into user activity, investigate incidents, maintain compliance, and prevent insider threat incidents.

2. INTENT

   Once an insider threat has been detected, and the investigation is under way, it is important to uncover the intent of the insider.

   Not all insider threat incidents are malicious, but there is only one way to know for sure: investigating trending activity by viewing a step-by-step, click-by-click log or session video recording of an insider’s actions.

3. LACK OF RESOURCES

   A common problem faced by cybersecurity teams (or any, really) is a fundamental lack of resources, or a mis-allocation of resources. Investigating insider threats, potential or not, can take a lot of time and people power! Particularly if the tools used to scour through log data require deciphering, or only capture part of the picture.

   Make sure that your setup allows you to see granular user activity details via a streamlined step-by-step trail or visual capture, that is easy to understand, and search rapidly.

4. EVIDENCE

   If you brought a case to court and had no evidence, you’d find yourself getting laughed out of the room. The same can be said for investigating an insider threat without evidence. You’ve got no case!

   As you’ll recall, the biggest problems with insider threat investigations are comprehensive visibility, and total resource use. If the processes and tools that you have in place take too much time to pull data from, or are less-than-understandable, they’re not really helpful.

   Remember: your stakeholders want insights and results, and they want them – fast!