Insider Threats Don't Always Start on the Inside

When you think about an insider threat, you envision a rogue employee stealing company secrets on a thumb drive or selling state secrets to foreign enemies. These scenarios all involve employees who are already on the job. But what about people seeking a job with the sole purpose of becoming an insider threat?

The North Korean IT worker scheme unlocked a new method of espionage, using fake credentials to get remote workers hired into IT roles, then exfiltrating proprietary source code and sensitive data. This concept isn't new. Extremists have long sought positions at companies whose missions clash with their ideology, aiming to disrupt operations from the inside. From ethnic supremacists to animal rights and environmentalist groups, insider threats have always posed huge risks to companies.

The data center industrialization boom, along with the Flock camera surveillance controversy, has now radicalized many more individuals and groups. The idea of dismantling the system from within cannot be understated.

Once an activist or saboteur lands a job, certain roles give them outsized power to cause damage. Security research identifies two key risk areas. The first is privileged system access: critical infrastructure engineers or IT administrators with backdoor access can plant "logic bombs," malicious code set to trigger catastrophic deletions of internal directories after they leave the company. The second is physical and logistical sabotage: access to support portals, visitor management systems, electrical cooling systems, or Integrated Lights-Out (iLO) remote hardware management tools give malicious insiders the ability to cause physical and network outages without ever tripping standard firewall defenses.

Performing complete and thorough background checks, including social media, becomes increasingly important under these circumstances. An individual consistently engaging with posts advocating for the destruction of data centers or commenting on pages known for hostility toward Flock cameras, is not going to show up on a standard background check.

What Organizations Should Do:

• Ensure every potential hire is thoroughly vetted, confirmed to be a human, and evaluated for potential insider risk.
• Leverage a trusted partner to complete diligence on the prospective hire’s social media presence in accordance with your hiring policy.

How Sentinel Can Help:

Sentinel helps organizations identify, assess, and respond to emerging integrity and reputational risks through intelligence-led risk assessments, monitoring, investigative support, training, and advisory services. For organizations navigating the ever-changing hiring landscape, proactive intelligence-led due diligence is the difference between identifying an issue before it becomes a problem vs having to pick up the pieces afterwards.

To learn more contact Sentinel at Info@Sentinel.Security