Combating insider threats with cyber threat intelligence

A comprehensive cybersecurity framework considers all kinds of threats—external and internal.

In fact, the latter is more important since it can be caused—knowingly or unknowingly—by ‘trusted’ and authorised employees, consultants, or partners known to the organisation, resulting in a data breach that could lead to IP theft and loss of revenue and reputation. 

The data leak of over 75,000 Tesla employees’ personal information by two former employees, the exposure of over 100 million Capital One customer accounts because of a vulnerability found by a third-party vendor, and Boeing’s nearly three-decade-long IP theft are some of the many stern examples of the damage caused by inside threats.

This trend continues to grow.

The Verizon 2023 Data Breach Investigations Report found that insiders were responsible for 25% of data breaches, which has costly consequences. The 2023 Cost of Insider Risks Global Report by Ponemon Institute has stated that the average cost of insider incidents has risen to $15.4 million per organisation—a 34% rise from 2020. 

Strengthening internal security

Keeping this growing threat in mind, cybersecurity experts must leverage cyber threat intelligence (CTI) to help organisations mitigate insider risks and strengthen internal security postures more effectively.

CTI collects, analyses, and disseminates information about potential or current attacks that threaten an organisation. It draws its information from various sources, including internal logs, security incidents, the dark web, threat feeds from security vendors, information sharing and analysis centres (ISACs), government agencies and regulatory bodies.

It plays a crucial role in combating insider threats by providing context, patterns, and indicators of compromise (IoCs) specific to internal risks. By analysing this intelligence, organisations can enhance their detection capabilities, improve response times, and implement proactive measures to prevent insider incidents in various ways.

Detect anomalies: Security teams can establish baseline behaviours for users and systems, making it easier to identify anomalies that may indicate insider activity. It includes unusual data access patterns, suspicious network traffic, unauthorised system modifications, and abnormal working hours or login locations.

Identify malicious behaviour: Correlating CTI with internal user activities can help organisations distinguish benign actions from potentially malicious activity. It might involve monitoring for data exfiltration attempts, tracking privileged account usage, analysing communication patterns, and identifying unauthorised software installations.

Assess risk: CTI can make risk assessments by providing insights into the most common insider threat tactics, techniques, and procedures. It allows organisations to prioritise security investments, implement targeted controls, develop scenario-based incident response plans, and conduct focused security awareness training.

Also Read

Fortifying healthcare through holistic cybersecurity strategies for an impenetrable digital defence

Integrating CTI into existing security measures

Most organisations will have some security framework in place. However, CTI should be integrated into the existing infrastructure to maximise its effectiveness. It will enable real-time threat detection along with automated response capabilities.

Further, it will foster collaboration between different security functions, providing a shared understanding of insider threats, and enhance incident response coordination, cross-functional threat-hunting initiatives, and communication with executive leadership.

Augment CTI with AI/ML

Artificial intelligence (AI) and machine learning (ML) can significantly augment CTI analysis in the fight against insider threats. These technologies are adept at identifying complex patterns in vast amounts of data—a crucial aspect while dealing with stealthy insider behaviour. ML algorithms can leverage historical data to predict potential insider threats, allowing organisations to take preemptive action.

AI-powered systems can automate security alerts by rapidly sifting through thousands of events to identify the ones most likely to indicate insider activity. It improves efficiency and reduces the risk of alert fatigue among security personnel.

These systems can be trained to continuously adapt to evolving insider threat tactics, ensuring defences remain robust through changing attack methodologies.

Also Read

Securing India’s move to the Cloud with compliance and cybersecurity

Best practices

Integrating CTI into the security framework for managing insider threats is a complex but crucial strategy. Cybersecurity professionals and IT decision-makers must ensure the CTI architecture is configured to minimise false positives and avoid disruptions to productivity.

Equally important is safeguarding employee privacy, which can be managed through transparent monitoring practices, responsible data handling, and well-defined retention policies.

While these challenges are real, they can be effectively mitigated with careful planning and adherence to best practices. Key steps include establishing a dedicated insider threat programme focused on detection, prevention, and response; investing in robust CTI platforms; implementing comprehensive employee awareness initiatives; and enforcing strict access controls that balance security with productivity.

Regular assessments, policy reviews, and updates are also essential to address emerging threats and adapt to organisational changes.

Organisations can significantly enhance their long-term resilience against insider threats, protecting their assets, reputation, and integrity by taking these measures.

Manish Chasta is the Co-founder and CTO of Eventus Security.