Insider Threats in Air-Gapped Networks: A Security Perspective

Mitigating the risks posed by insiders with legitimate access is a complex challenge in the field of cybersecurity.Even with cutting-edge security policies in place, malevolent insiders remain a significant threat to businesses due to their comprehensive awareness of organizational assets and processes, which may include exploitable vulnerabilities.This threat is particularly concerning for air-gapped networks, which are frequently utilized by security-sensitive entities such as the military, critical infrastructure, finance, and research and development institutions.While these networks are difficult to hack from the outside, they are highly susceptible to insider attacks.While there are existing insider danger taxonomies for general computer networks, they do not account for the unique risks associated with malicious insider in air-gapped networks.As a result, authors have developed a new taxonomy that focuses on the actions taken by trusted individuals.Our research involved identifying the shortcomings of current taxonomies and mapping real-world instances of insider threats to our proposed taxonomy.Our findings suggest that successful exploits in air-gapped networks require both physical and cyber-world components.