Insider threat programmes: Time to hit restart

Insider threat programmes exist to protect sensitive data and assets from internal threats. While most organisations are comfortable with setting up programmes and technologies to protect against external threats, insider threat programmes have historically been harder to implement due to difficulties with technologies and creating the partnerships necessary to achieve success. Now that so many organisations face distributed working environments and increasing cloud-based collaboration tools, insider threat programmes are both more important than ever, as well as more difficult to implement based on typical insider threat programme frameworks. To address this new reality, we propose a new insider threat programme framework that enables cross-organisational collaboration while protecting critical assets and information. This framework consists of 21 controls broken down in people, process and technology pillars. It allows an organisation to make decisions based on the risk appetite of the organisation, while staying away from strict technology requirements that hamper collaboration. By focusing on visibility to data movement instead of blocking data access, this new approach allows for appropriate levels of collaboration in a distributed environment. This paper outlines some of the challenges that exist in traditional insider threat maturity frameworks as well as in the traditional prevention and blocking focused tools such as DLP.