When a business owner hears “insider threat,” the picture is a disgruntled employee copying files to a thumb drive on his last Friday. That happens. It is not the common case, and if it is the only case you plan for, you will spend money on the wrong things and make your office worse to work in.
The realistic version is duller. A salesperson still has access to a folder from the department she left two years ago. A contractor’s account is still active eight months after the project ended. A well-meaning employee forwards a customer list to his personal address so he can work Sunday night. None of these people are villains. All of them are insider risk, and all of them are fixable with process rather than suspicion.
What “Insider” Actually Means
CISA defines an insider broadly as “any person who has or had authorized access to or knowledge of an organization’s resources.” Note the “or had.” The account you forgot to close still counts. So do vendors, contractors, and anyone who knows your pricing or where the customer data lives.
CISA’s definition of the threat is the part worth reading twice: “the threat that an insider will use their authorized access, wittingly or unwittingly, to do harm.” Wittingly or unwittingly. The agency splits unintentional insider threat in two. Negligence covers people who “are familiar with security policies but choose to ignore them, creating risk,” like propping a door or postponing an update for months. Accidental covers those who “mistakenly cause an unintended risk,” like sending sensitive information to the wrong recipient.
CISA also names collusive threats, where an insider works with an outside party, and third-party threats from contractors and vendors. Malicious insiders are real and belong on the list. They are not where most of your exposure sits.
Access Creep Is the Quiet Problem
Access accumulates. Someone joins accounting, gets the accounting shares. Covers for a colleague in HR, gets HR. Helps on a project in operations, gets that too. Nothing is ever removed, because removing access is a favor nobody asks for and everybody resents.
After a few years you have people who can read most of the company. That matters for two reasons that have nothing to do with their character. One phished account now exposes far more than it should, and when something goes wrong you cannot narrow down what was touched, because everyone could touch everything. This is the same reason basic security hygiene stopped being optional as companies grow past a dozen people.
The fix is least privilege, which sounds severe and is not. Access is tied to the job someone does now, not the sum of every job they have held. In practice:
- Grant by group, never by person. Put permissions on a role like “Accounting” and put people in the role. Individual grants are invisible six months later.
- Make transfers remove as well as add. A move between departments should trigger a review of what the old role required. This prevents most creep.
- Review the sensitive stuff twice a year. Not everything. Payroll, banking, customer data, administrator accounts. A 30-minute look at four lists beats an annual project nobody finishes.
- Separate everyday accounts from administrator accounts. Nobody should read email and manage the identity system from the same login.
- Write down who owns each system. Every application needs a named person who decides who gets in. Unowned systems are where stale access hides.
The Departing Employee Who Thinks the Files Are Theirs
Here is a scenario we see often. A salesperson resigns and takes her contact list. In her mind she built those relationships, so the list is hers. She is not sneaking anything. She would tell you about it if you asked.
Legally and practically that is usually your company’s data, but nobody ever told her otherwise. No conversation at hire, nothing in the handbook she read, no reminder at exit. The failure is yours before it is hers.
So make it explicit and unremarkable. Say at onboarding which categories of information belong to the company. Say it again at exit, in writing, in a sentence a normal person can understand. Most people follow rules they know about. The few who will not are why you keep records, but do not design your culture around them.
The same conversation covers work that quietly moves onto tools the company never approved, from personal cloud drives to a departmental app somebody expensed. We covered that in our piece on shadow IT, and it overlaps heavily here, because data on a tool you do not control cannot be recovered when someone leaves.
An Offboarding Checklist That Actually Closes Doors
Most offboarding fails the same way: email gets disabled and everything else is forgotten. Run this list the same way every time, so it never depends on who handles the departure.
- Disable the account rather than deleting it. Deleting can destroy records you may need. Disabling keeps the evidence and stops the access.
- Revoke active sessions, not just the password. A signed-in phone can keep working after a password change. Microsoft’s guidance for compromised accounts makes the point plainly: revoking active sessions “immediately invalidates any active access using the stolen credentials.” The same applies to a departure.
- Collect and wipe company devices, including phones with work email, hardware security keys, door codes, and alarm codes.
- Work the application list, not just email. Accounting system, CRM, file sharing, shipping portal, card processor. This is why you keep a list of who owns each system.
- Rotate shared credentials the person knew. Shared logins are a bad idea, and until they are gone, treat every departure as a reason to change them.
- Handle the mailbox deliberately. Decide who receives forwarded mail, for how long, and who keeps the archive.
- Do the same for contractors and vendors, setting an end date when access is granted so it expires on its own if nobody remembers.
Where to Stop Before It Becomes Surveillance
You can buy software that scores employee trustworthiness, records screens, and reads messages. Some regulated organizations need parts of that. Most small businesses do not, and the cost is not only the license fee. Teams that feel watched stop reporting their own mistakes, and self-reported mistakes are how you catch problems while they are small.
CISA frames this work as four steps, “Define, Detect and Identify, Assess, and Manage,” and describes a holistic program as one that “combines physical security, personnel awareness, and information-centric principles.” Notice what does the heavy lifting: awareness and information handling, not observation of individuals. Our practical line:
- Log systems, do not watch people. Keep audit logs on file access, administrator actions, and large downloads. Review them when something prompts you to.
- Alert on events, not employees. A mass download at 2 a.m. is worth a look. Reading a normal number of files at 2 p.m. is not.
- Tell people what is logged. Disclosure costs nothing and removes the sense that something is happening behind their backs.
- Make reporting mistakes safe. The employee who says “I think I clicked something” within five minutes is the best security control you own.
The Bottom Line
Insider risk is mostly an access management problem wearing a scary name. Give people the access their current job needs, take it back when the job changes, close every door when they leave, and say plainly what belongs to the company. That handles the careless majority and shrinks what a rare bad actor can reach, without putting your team under a microscope.
It is also the work that limits damage from an outside attacker, since a phished account can only reach what that account could already reach. If you want a second set of eyes on who has access to what, or an offboarding process that closes every door, we can help. Contact us today.
Sources:
Comments are closed