Insider Threat (Intentional)

What Is Insider Threat (Intentional)?

A malicious insider abuses access they are supposed to have, which is why these cases surface slowly. In this exercise a colleague's behavior starts to form a pattern: a late-night copy from a client share to a personal USB stick, a nervous cover story, and a confidential file shared to a personal email account. None of it is damning on its own. You will decide when a behavior is reportable, who to escalate it to, and how to document what you saw without confronting the person.

What You'll Learn in Insider Threat (Intentional)

• Identify behavioral warning signs of intentional insider threats, including unusual access patterns, after-hours activity, and interest in data outside normal job responsibilities
• Distinguish between accidental policy violations and deliberate data exfiltration based on context, frequency, and pattern
• Report suspicious insider behavior through proper channels without directly confronting the individual
• Document observed indicators accurately and factually to support a security investigation
• Understand why authorized users pose a unique detection challenge compared to external attackers

Insider Threat (Intentional) — Training Steps

1. Working Late

   It is Thursday evening at Stratford Financial. Alice has stayed late to finish a quarterly report, and most of the floor has already gone home. Marcus Sterling comes back to the desk across from hers and sits down at his computer. That is unusual: he normally leaves early. Over the past few weeks he has also grown withdrawn, takes his calls in the stairwell and minimizes his screen whenever someone walks by.

2. The USB Stick

   Marcus takes a USB stick out of his pocket and pushes it into his workstation. He glances over his shoulder, then turns back to the screen and starts dragging folders from the Client Portfolio share onto the stick.

3. He Sees Alice

   Marcus looks up from the screen and finds Alice watching him. The copy is still running.

4. Into the Bag

   He pulls the stick out before the copy finishes, drops it into his bag and gets up, the bag already on his shoulder.

5. A Forced Smile

   Marcus puts on a smile that does not reach his eyes and offers Alice an explanation she did not ask for.

6. Gone for the Night

   Marcus walks out with the bag on his shoulder. Alice finishes her report and heads home, but the stick and the smile stay with her.

7. A Troubling Discovery

   The next morning, Alice arrives at work and checks her email. She notices a strange message in her inbox - it looks like an automated notification from the document management system. The notification indicates that Marcus shared a large file with an external email address late last night.

8. Connecting the Dots

   Alice pauses to consider what she's seen: Marcus working late and acting secretive Copying files to a personal USB drive Sharing confidential client data to a personal Gmail account The file contained sensitive portfolio information marked 'CONFIDENTIAL' Any one of these could have an innocent explanation. But together, they paint a concerning picture. An intentional insider threat is when a trusted employee deliberately misuses their access to harm the organization. This can include: Data theft - Stealing confidential information, trade secrets, or client data Sabotage - Damaging systems, deleting files, or disrupting operations Fraud - Financial manipulation for personal gain Espionage - Selling information to competitors or foreign entities Insiders have legitimate access, making their actions harder to detect than external attacks.

9. Recognizing Warning Signs

   Insider threats often exhibit observable warning signs - both behavioral and technical: Behavioral Indicators: Working unusual hours without clear business need Expressing dissatisfaction, grievances, or intention to leave Becoming secretive - minimizing screens, taking calls privately Financial stress or living beyond means Downloading or accessing data outside normal job duties Technical Indicators: Large file transfers to personal devices or cloud storage Accessing systems at unusual times Copying files marked as confidential or restricted Using unauthorized USB drives or external media Emailing documents to personal email accounts Alice knows that reporting a colleague is uncomfortable. She and Marcus have worked together for two years. But she also understands that failing to report could enable significant harm to clients and the company. Stratford Financial has an anonymous reporting hotline and a secure reporting portal specifically designed to protect employees who come forward with concerns.

10. Accessing the Reporting Portal

    Alice decides to submit a confidential report through the company's Insider Threat Reporting Portal. This portal is specifically designed for employees to report concerns about potential insider threats while maintaining confidentiality.