Experience Paper: Uncovering a Privileged Insider Threat in Action

Insider threats pose a persistent and significant challenge to corporate security. The threat escalates dramatically when the malicious insider is a member of the IT or cybersecurity team. Their inherent knowledge, access and privileges makes it extremely difficult to prevent, detect or deter malicious activity performed by insiders who operate inside the security team. Traditional security controls such as User Entity Behaviour analytics (UEBA), Data Loss Prevention (DLP), Privileged Access Management (PAM), Identity Threat Detection and Response (ITDR), Endpoint Detect and Response (EDR), Network Traffic Analysis (NTA) are designed to detect External Threats. While monitoring behavioural and psychological indicators, such as employee dissatisfaction or financial pressures, can be useful for Insider Threat detection, these methods are often insufficient when the insider resides within the IT or cybersecurity team. Privileged Insiders can use their knowledge of the security tools deployed, its configurations and whitelists to evade defenses. Deception technology offers a unique capability to detect insider threats, even those originating from privileged teams within IT or cybersecurity. This cyber deception practitioner's paper uses a real-world case study to describe how deception was the only tool that detected a malicious insider working in the security team of a large enterprise operating in a highly regulated industry. This paper provides details on the key deception design principles that enabled the Defense team to catch the malicious privileged insider.