thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Insider Threat

A risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.

Definition

Insider threats can be malicious (sabotage, theft of intellectual property, fraud) or unintentional (careless handling of data, falling for phishing). Because insiders already have legitimate access and knowledge of controls, their activity is harder to detect with perimeter tools. Controls include least privilege, separation of duties, user behavior analytics and data loss prevention.

Example

An engineer copying source code to a personal cloud drive before resigning is a malicious insider threat.

Exam tip

Insiders are "internal" actors with existing access; UEBA and DLP are the usual detective answers.

Don't confuse it with

Related terms