Insider threat hunting best practices and tools

The importance of insider threat hunting

While traditional security measures, such as firewalls, intrusion detection systems and antivirus products, help guard against external threats, they are often less than perfect at catching malicious actions that originate from within the enterprise. This is where insider threat hunting comes into play. Unlike reactive detection where security teams respond to known threats or anomalies after they've occurred, insider threat hunting is proactive. It involves searching for potential threats before they turn into an actual security incident.

Insider threat hunting is important because of the unique challenges insiders present. Whether due to an employee intentionally leaking sensitive data or an unintentional error causing data exposure, insiders are difficult to monitor because they usually have legitimate access to the organization's critical assets.

A proactive threat hunting stance ensures organizations can identify early warning signs of insider risks, enabling teams to neutralize the threat before significant damage is done.

Proactively hunting for and detecting potential insider risks is essential to prevent organizations from falling victim to data breaches, intellectual property theft and operational sabotage.

Key insider threat indicators

Several behavioral indicators suggest the presence of an insider threat. Security teams should be on the lookout for the following signs:

• Unusual data access. A common indicator of insider threats is when employees access files, folders or systems outside their usual roles or responsibilities. For example, a marketing employee who starts downloading sensitive HR or financial data should raise a red flag.
• Excessive downloading. Employees who begin downloading or copying large amounts of data, especially over a short period of time, could be preparing to exfiltrate information and possibly leave the company. This is particularly concerning if the data isn't relevant to their current job duties.
• Behavioral changes. Sudden shifts in an employee's behavior, such as becoming disgruntled with the job or the company, working odd hours without explanation or showing a lack of engagement, can signal potential insider risk. Malicious insiders often exhibit noticeable behavior changes before acting against the organization.
• Use of unauthorized devices or software. Closely monitor for employees using unauthorized devices, such as USB drives or unapproved software for data transfer. This activity could signal intent to move sensitive data off the network to avoid detection.
• Repeated failed access attempts. Multiple failed login attempts, especially to systems or data an employee shouldn't access, can indicate an insider trying to gain unauthorized access to sensitive areas.

The above symptoms can be easily tracked, often with existing tools. This is something the security team should create and coordinate to make sure the actions being taken are aligning with company risk management guidance.

Organizations most at risk of insider threats

Certain organizations are more susceptible to insider threats than others, given the nature of their businesses or operational environments. Industries that handle high volumes of sensitive data, such as healthcare, finance and technology, are prime targets for insider threats. Similarly, organizations undergoing major changes, such as mergers, layoffs or leadership transitions, are also at heightened risk. Employees who feel uncertain about their job security could be more likely to leak data or sabotage systems. These targets help focus the monitoring of insider threat indicators above.

Remote work environments can further exacerbate insider risks. This has exploded since the COVID-19 pandemic. While many employers are looking to bring employees back to the office, some employees are pushing back, trying to maintain the "new normal" work environment. With employees working outside the traditional security perimeter, it is more challenging for organizations to monitor activities and enforce access control policies effectively.

Insider threat hunting best practices

The following technologies and techniques are key to successful insider threat hunting:

• Regular and consistent monitoring. Threat hunting shouldn't be a one-time event, but rather an ongoing process. Regular monitoring of employee activities, especially those users with access to critical systems, helps establish baselines for normal behavior and identify deviations early.
• Automation and machine learning. Automation tools can significantly enhance the efficiency of insider threat hunting efforts. Machine learning algorithms can analyze vast amounts of data to detect patterns of suspicious behavior that might otherwise go unnoticed. Automating routine tasks, such as scanning for unusual file access or abnormal network traffic, enables security teams to focus on higher-level analysis.
• User behavior analytics. Implementing UBA tools helps detect insider threats by identifying abnormal patterns in user behavior. These tools create profiles based on normal user activity and alert analysts when actions deviate from the baseline.
• Incident response planning. Having a clear incident response plan in place is crucial. When a potential insider threat is detected, security teams must respond quickly and decisively to mitigate any damage. While most companies update incident response plans annually, it's safer to review them at least quarterly, with the ultimate goal of continuous analysis and updates based on the ongoing threat environment.
• Cross-team collaboration. Insider threat detection is not just the responsibility of the security operations center. HR, legal and IT teams should all be involved in detecting and mitigating insider threats. Coordinating with these departments ensures a comprehensive approach to identifying warning signs across the organization. And the more often companies rehearse incident response and disaster recovery planning, the more likely they are to work effectively together and more quickly identify operational anomalies.

Insider threat hunting and detection tools

The following tools can assist with insider threat hunting and detection:

• SIEM. SIEM platforms collect and analyze security data from various sources to provide insights into potential insider threats.
• Endpoint detection and response and extended detection and response. EDR products monitor endpoints for suspicious activity, such as unauthorized file access or unusual network connections, which could indicate an insider threat. XDR products are more comprehensive and increasingly under consideration by the enterprise.
• Data loss prevention. DLP tools monitor, detect and prevent the unauthorized transfer of sensitive data, reducing the risk of insider data exfiltration.

Proactive insider threat hunting is an important component of modern cybersecurity strategies. By understanding key threat indicators, implementing best practices and using advanced tools, organizations can help protect themselves from the potentially devastating consequences of insider threats.

Jerald Murphy is senior vice president of research and consulting with Nemertes Research.