Insider Threats: Not Every Threat Comes From Outside

Introduction

When we think about cybersecurity threats, we often imagine an attacker somewhere outside the organisation trying to break into a system. But not every threat comes from outside.

People who already have legitimate access to institutional systems, networks, applications and information can also create cybersecurity risks. These are insider threats.

An insider threat is not always intentional; mistakes, poor security practices, compromised accounts, or misuse of access can expose sensitive data or disrupt services.

For universities and research institutions, where staff, students, researchers, administrators and external partners have access to many systems and large amounts of information, understanding insider threats is particularly important.

What Is an Insider Threat?

An insider threat is a security risk caused by someone who has legitimate access to an organisation’s systems, information or facilities.

This could be:

  1. An employee
  2. A researcher
  3. A lecturer
  4. A student
  5. An administrator
  6. An intern
  7. A contractor or service provider
  8. Someone using a legitimate account that has been compromised

Insider threats generally fall into three categories:

  1. Accidental: The person does not intend to cause harm but makes a mistake.
    For example, a staff member may accidentally send confidential student information to the wrong email address or upload research data to an unintended location.
  2. Negligent: The person knowingly or unknowingly ignores security practices and creates unnecessary risk.
    For example, someone may share their password, leave a computer unlocked, install unauthorised software or use a personal device to access sensitive information without following institutional procedures.
  3. Malicious: The person deliberately misuses their legitimate access.
    For example, an employee may intentionally copy confidential research information, access records they are not authorised to view, or take institutional information before leaving the organisation.

There is also another important category to understand: compromised insiders.

An attacker may steal or take control of a legitimate employee’s account and use it to access systems. From the organisation’s perspective, the activity may initially appear to be coming from a trusted user.

How Do Insider Threats Happen?

Insider threats can happen in many ordinary situations.

(a) Sharing passwords

A staff member gives their password to a colleague so that the colleague can access a system on their behalf.

Why is this risky?

It becomes difficult to determine who actually performed an action, and the shared password may eventually reach someone who should never have access.

(b) Sending information to the wrong person

An employee accidentally sends a confidential document to the wrong email address.

This could expose:

  • Student records
  • Financial information
  • Research data
  • Staff information
  • Institutional documents
(c) Using unauthorised software

Someone downloads an application or tool without checking whether it is safe or approved.

The software could contain malware or introduce vulnerabilities into an institutional device.

(d) Using personal storage

A researcher copies institutional or research data to a personal cloud account, USB drive or personal computer for convenience.

If that device or account is compromised, the institutional data may be exposed.

(e) Leaving devices unattended

An unlocked computer can give anyone nearby access to email, files, applications or other systems.

Something as simple as “I’ll only be away for a minute” can create an opportunity for misuse.

(f) Misusing legitimate access

A person may access information simply because they can, even though they have no legitimate reason to do so.

Having access does not automatically mean having permission to view or use everything.

Warning Signs to Take Seriously

Not every unusual action means someone is an insider threat. However, certain behaviours should receive attention, especially when they violate established procedures.

Examples include:

  • Accessing information unrelated to someone’s role
  • Repeatedly attempting to bypass security controls
  • Sharing credentials with others
  • Copying large amounts of information without a clear reason
  • Using unauthorised storage devices or services
  • Installing unauthorised software
  • Attempting to access systems after responsibilities have changed
  • Sending sensitive information through personal accounts
  • Unusual login activity from a legitimate account
  • Disabling or attempting to bypass security tools
  • Requests for access that do not match someone’s job responsibilities

The important point is not to investigate or accuse someone yourself. Suspicious activity should be reported through the appropriate institutional channels so that it can be assessed properly.

How Can We Reduce Insider Threats?

Preventing insider threats is not about assuming everyone is dangerous. It is about making sure that legitimate access is used safely and responsibly.

(a) Use least privilege

Users should have only the access they need to perform their responsibilities. If someone does not need access to a particular system or dataset, they should not have it.

(b) Protect your credentials

Never share passwords, MFA codes, authentication tokens or other credentials. If someone needs access to a system, they should receive their own authorised account.

(c) Lock your devices

Always lock your computer when stepping away, even for a short time.

(d) Follow institutional procedures

Security controls and procedures are there to protect both the institution and its users. Do not bypass them simply because a different method seems faster or easier.

(e) Be careful with data

Before downloading, copying, emailing or uploading institutional information, ask:

Do I need to do this? Am I authorised to do this? Is this an approved location or service?

(f) Report compromised accounts quickly

If you suspect that your account has been compromised, report it immediately. The sooner the security team knows, the sooner they can investigate, revoke sessions, reset credentials and prevent further access.

(g) Review access regularly

Institutions should regularly review user accounts and permissions, particularly when people:

  • Change roles
  • Leave departments
  • Complete projects
  • Graduate
  • Leave the institution
  • Finish contracts or internships

Access that is no longer required should be removed promptly.

What Should You Do If You Notice Something Suspicious?

Do not ignore it simply because you are unsure.

You should:

  1. Stop – Do not interact further with suspicious activity.
  2. Verify – Check whether the activity has a legitimate explanation.
  3. Report – Notify the appropriate ICT or cybersecurity team.
  4. Preserve information – Keep relevant emails, messages, screenshots or other evidence where appropriate.
  5. Do not confront or accuse the person yourself.

Early reporting can help security teams investigate an issue before it becomes a major incident.