Bookmark and Share

The Increasing Impact of Insider Threats

What is an insider threat? Moderator John Abel and his participants first sought to answer that question at this roundtable discussion. They defined an insider threat as someone who has privilege, someone who is trusted, and perhaps even someone who is an employee making a mistake. Within that context, the participants then discussed how they would detect an insider and what sort of actions would be looked for as giveaways. A surprising find during the conversation was that both the moderator and the participants were all in the early stages of their journey in dealing with insider threats. While they have been faithfully using older techniques such as data loss prevention and manual detection, they are looking toward what newer techniques—such as AI, machine learning, and behavioral analytics—are available to pinpoint and remediate insider threats more effectively. To anticipate using these techniques, the table discussed what signals they would be alerting for and how they would train their technology to identify these signals coming from either employees or from any insider threat who seeks access to their networks.