In this lesson,
we are going to dive into the world of insider threats.
Insider threats pose a unique
and they are often overlooked.
They refer to the cybersecurity threats
that originate from within an organization.
These insider threats can come from current
or former employees, contractors,
or business associates who have legitimate access
to the organization's systems data.
Unlike external threats,
insider threats have an intimate knowledge
of the organization's infrastructure,
which makes them potentially more damaging
than an external attacker.
For example, if a threat actor is trying to break
into an office building,
but they have never been inside the building before,
it's going to be pretty difficult
since they have no pre-existing knowledge
of the building's security features,
or even the building's layout.
On the other hand,
if you have a disgruntled employee who wants to gain access
to the building, it's pretty easy for them to do so.
They already have an access badge, or access code,
since they work in the building every day
and they know the layout of the building
because they work there every day
and they know the security processes and procedures.
Well, the same thing happens in the digital world
and our trusted insiders can easily become a problem for us
if they switch sides and become an insider threat
to our organizations and our networks.
Insider threats have varying levels of capabilities,
and these are largely determined by the individual's role
and level of access within the targeted organization.
For example,
if an individual has extensive access privileges
because they work as a system administrator for the company,
they could potentially cause significant damage.
On the other hand,
if the individual only has limited access rights
to the system,
they may not be able to cause widespread damage
to the organization's network,
but another factor in determining
the individual's capabilities
is their own level of knowledge.
For example, a skilled attacker who has
a regular user account on the organization's system
because they're working as an unpaid earn intern
or receptionist who causes much or more damage
than an unskilled,
entry-level system administrator on the same system,
even though the system administrator
has higher levels of access by default.
When it comes to insider threats,
you should be aware that insider threats
can take various forms,
including data theft, sabotage,
or the misuse of access privileges.
Insider threats can also help to facilitate external attack,
such as installing malware or creating backdoors
in organization systems based on their motive and intent.
Each insider threat is driven by different motivations.
Some are driven by financial gain and they want to profit
from the sale of sensitive organizational data to others.
Some other threats may be motivated by revenge
and are aiming to harm the organization
due to some kind of perceived wrong levied
against the insider.
For example, a recently fired employee might attempt
to take some of the company's sensitive information
with them on their last day,
and they could publicly leak it
or send it to the organization's other competitors.
In some cases, insider threats may be unintentional
or simply the result of carelessness
or a lack of awareness of cybersecurity best practices
by one of the organization's users.
A common example of this type of insider threat
would be an untrained employee clicking on a link
in a phishing email
and it accidentally allowed access to the workstation
and an turn,
it could potentially compromise the company's network.
One of the most infamous examples of an insider threat
is the infamous case of Edward Snowden,
a former contractor for the US National Security Agency,
or the NSA.
Now, some people believe he was a whistleblower
and a privacy advocate,
but from the perspective of his employer,
the NSA and the US government,
he has been classified as an insider threat.
Back in 2013, Edward Snowden leaked a vast amount
of classified information to the media
to reveal extensive global surveillance programs run
by the National Security Agency that he disagreed with.
His intimate knowledge of these systems
and his access privileges allowed him
to gather a ton of data without the NSA ever detecting it,
and then Snowden was able to leak this information
to bring light to different surveillance programs used
by the NSA.
This really does show how much damage
a trusted insider like Snowden can do
since they already have legitimate access
to the organization, its network, and its data.
After the cleanup of the incident,
the Director of National Intelligence, James Clapper,
described the Snowden disclosures as the most massive
and most damaging theft of intelligence information
in the history of the United States.
It is hard to provide a cost estimate for this incident
since much of the impact revolved around national security,
intelligence capabilities, and diplomatic relations,
but some estimates put the cost
into the billions of dollars, lost capabilities,
and technological advantages against the enemies of the US.
Another example of an insider threat
is the Twitter attack of 2020.
Back in the year,
Twitter fell victim to an attacker who collaborated
with two insider threats
to achieve the goals of this attack.
The young attacker managed to gain access
to several high profile Twitter accounts,
including those of Elon Musk, Barack Obama,
Joe Biden, Bill Gates, among others.
The attacker used this unauthorized access
to launch a Bitcoin scam by attempting to mislead followers
of these influential Twitter accounts.
The attack was a stark reminder of the risks associated
with insider threats and highlights the importance
of robust internal cybersecurity controls,
even in tech savvy organizations
like the formal social media giant, Twitter.
So remember, an insider threat refers
to the potential risk posed by individuals
within an organization who have access
to sensitive information and systems
and who may misuse this access
for malicious or unintended purposes.
To mitigate the risk
of an insider threat being successful,
organizations should implement a zero trust architecture,
employ robust access controls, conduct regular audits,
and provide effective employee security awareness programs.