Security risk from people within the organisation—employees, contractors, or partners with legitimate access.
Insider threats originate from people with legitimate access to an organisation's systems—employees, contractors, vendors, or partners. Insiders may act maliciously (stealing data, sabotage), negligently (accidentally exposing data), or be compromised (credentials stolen). Insider threats are particularly dangerous because insiders have authorised access and knowledge of systems and data. Detection requires monitoring user behaviour, implementing least privilege access, and maintaining proper offboarding procedures.
Why It Matters
The DSC Perspective:
Insiders bypass perimeter security by definition. Many breaches involve insider elements—whether malicious or negligent. Access controls, monitoring, and security awareness help manage insider risk.