# Insider threat

> A security risk that comes from someone who already has legitimate access.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/insider-threat/
- In Spanish: [Amenaza interna](https://tidbit.legios.com.ar/es/insider-threat/)

Most defenses are built to keep strangers out: firewalls, passwords, two-factor authentication. An **insider threat** is the risk that comes from people who are already in: employees, contractors, partners, anyone with a badge or a login. They do not need to break anything, because the system already trusts them.

Insiders come in three flavors. The malicious one acts on purpose: a salesperson who downloads the client list before leaving for a competitor, a disgruntled admin who deletes backups, someone paid to leak secrets. The careless one makes a mistake: emails a spreadsheet full of personal data to the wrong address, leaves a storage bucket public, falls for a phishing email. The compromised one is a real employee whose account has been taken over by an outside attacker, who now looks exactly like an insider.

Defending against insiders is mostly about limits and visibility. Give each person only the access their job needs and remove it the day they leave. Split critical powers so no single person can, say, approve and pay an invoice alone. Log who accesses what, and look for unusual patterns, like someone downloading far more files than usual at 2 a.m. And build a culture where people report mistakes quickly instead of hiding them, since many incidents start as honest errors.

## An analogy

A bank vault with a perfect steel door does not help much if the employee who knows the combination decides to empty it, or writes the combination on a sticky note.

## Keep in mind

- Comes from people who already have legitimate access.
- Three kinds: malicious, careless and compromised insiders.
- Least privilege and fast offboarding are the first defenses.
- Logging and spotting unusual behavior catch what permissions miss.

## Go deeper

- [Insider threat on Wikipedia](https://en.wikipedia.org/wiki/Insider_threat)
- [What are insider threats? (IBM)](https://www.ibm.com/think/topics/insider-threats)
- [Insider threat (NIST glossary)](https://csrc.nist.gov/glossary/term/insider_threat)

## Related terms

- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.
- [Backup](https://tidbit.legios.com.ar/backup/): A separate copy of your data, kept so you can get it back when the original is lost.
- [Spreadsheet vs database](https://tidbit.legios.com.ar/spreadsheet-vs-database/): Why a company that runs on Excel eventually needs a real database.
- [Personal data and GDPR](https://tidbit.legios.com.ar/personal-data-and-gdpr/): Information about you, and the laws that say who can use it and how.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Zero trust](https://tidbit.legios.com.ar/zero-trust/): Security that checks every request, instead of trusting whatever is inside the network.