Insider Threats – Trust But Verify

What you don’t know about what your employees are doing behind your back can destroy your business. Enter predictive insider risk management tools.

We all want to trust our staff.  After all, we went through a long and expensive process to hire them, get them up to speed, and set them on the path to achieving our aligned goals.

What happens when those goals start to diverge? What happens when an employee decides to jump ship for higher pay or a change of scenery? It would be ideal if when that happens, both parties leave feeling sad for the loss and optimistic about the future. Sometimes that isn’t the reality though.

When I was a young guy, maybe 8 or 9, I would go visit my dad at work on occasion. This was always a great time. I loved the noise and smells of the machinery in the plant, and the nice receptionist lady that always gave me a candy. That lady and some other staff would come to dinners at our home on occasion. They sometimes attended family outings. It was very much a family business and they were very much part of the family. It wasn’t until my early twenties when I saw the nice candy lady being escorted off the property in handcuffs that I understood that no matter how much you trust your staff, you cannot turn a blind eye and hope for the best. It turns out that she used my family’s trust to embezzle hundreds of thousands of dollars over the years. I never found out why she stole from us. I only remember the betrayal and the deep sadness of my dad and grandparents who had started the company in the 50's with the intention of building something with integrity that would sustain our family for generations.

The old adage of ‘trust but verify’ is very relevant in today's computing age. It is an old Russian proverb that was adopted into English during the nuclear disarmament of the 80’s. It defines the ability of potential adversaries to find common ground and use a third party to mediate and verify that each party is living up to it’s agreed upon obligations. During the cold war this meant that both the US and Russia would deprovision their nuclear arsenals to some degree in order to de escalate the growing conflict. They used the UN to inspect nuclear facilities to make sure that both parties were doing what they agreed to do.

In a business setting, it isn’t quite as tense a situation, but the concept can be scaled down. The ‘third party’ in a business setting are tools that use AI and predictive analytics to discern if anomalous behaviour is occurring. A common approach to this ‘risk-based detection’ is to look for situations that don’t match up with what an employee’s predictive model suggests they should be doing.

Eg. They send, on-average, 100 emails per day, but on Friday of last week they sent 1000 messages to a single recipient. The AI might flag this odd behaviour and suggest that an employee may be exfiltrating data. You’d receive an alert and get an opportunity to investigate the situation before it becomes a lawsuit or worse, a criminal proceeding.

Here are a few things that can be done with these insider threat detection tools.