The XDR Gap – Dealing with Insider threats
-
Cyber Operations - Cyber Risks, Recon Blogs
Cyber risk continues to run rampant in today’s information and communications technology (ICT) world. With more businesses moving to the cloud, increasing complexities in IT environments, adopting new applications/technologies, catering for remote and hybrid workers, and adopting Gen AI (Gemini and Copilot) tools, business risk levels keep rising.
These reasons all fuel the need for greater visibility into the day-to-day operations of ICT, and companies are looking for answers. According to the 2024 Insider Threat Report, over 83% of organisations reported at least one insider attack last year, making this the largest area of cyber concern today. This rate of attacks is a significant issue, with reported insider threats surpassing public breaches.
Organisations most commonly seek XDR/MDR solutions to fulfil their cyber protections. XDR solutions, however, don’t cater for insider threats. Unlike the common threats from hacks, malware, and viruses, the insider threat is already ‘authenticated’ to your systems. XDR/MDR will protect you from public threats by matching patterns, but the patterns for insider threats are always unique.
Common insider threats:
- Data Breaches: Most data breaches today utilise an exposed insider (person or system).
- Intellectual Property theft: Losing even part of your IP and/or trade secrets can impact your competitive edge in the market.
- Sabotage: Disgruntled staff can cause havoc through system damage, system disruption, and reduced productivity, leading to reduced revenue or increased costs.
- Fraud: In more extreme cases, we have seen users embezzle company funds or create dummy/duplicate transactions for personal gain.
- AI Bots: With the increased adoption of AI bots, too many companies are discovering they leak confidential data outside, especially at the business logic layer.
As you can see, none of these fit within the familiar realm of XDR/MDR solutions. In fact, traditional SIEM solutions don’t deal with these use cases ‘out of the box’. There is a discussion on whether Gen AI-based anomaly detection can discern this, but most anomaly detection engines need an occurrence to create a baseline.
Key Strategies for Effective Insider Threat Mitigation
- Build a Cross-Functional Insider Risk Program – Create a dedicated insider risk initiative that brings together stakeholders from security, HR, legal, compliance, and operations. This collaborative structure focuses on employee behavior and performance trends that may indicate potential threats.
- Enforce Strict Access Controls – Apply the principle of least privilege to ensure users can access only what’s necessary for their roles. Conduct regular access audits to prevent privilege creep, implement robust authentication.
- Establish data policies and practices – Establish data handling practices and ensure data classification is required. Create alerting mechanisms for the onerous use of data points.
- Build up Data Loss Prevention – Know your confidential files and systems. Some level of authorisation is required to access sensitive data. Create active alerting when this data is used.
- Use User Behavior Analytics (UBA) – Incorporate UBA into your Observability (not SIEM) functions that monitor user activity and detect anomalies such as unusual login times, large-scale data downloads, or logins from unexpected locations. Real User Monitoring (RUM) offers early detection of insider threats, enabling swift intervention.
- Develop an Insider Threat Response Plan – Establish a response framework tailored to insider incidents, including defined roles, communication protocols, containment procedures, and legal guidance. Include anonymous reporting channels to encourage whistleblowing without fear of retaliation.
Whilst these look simple, they must be applied across a wide gamut of ICT elements in business today (on the cloud, in applications, and on-premises). Insider risk isn’t going away. It is the fastest-growing threat in ICT, yet due to your business’s unique nature, a solution like XDR/MDR doesn’t address this concern.
Ready to tackle insider threats effectively?
Insider risks require a proactive and tailored approach to secure your business. With Recon’s QUAD, powered by the convergence of telemetry, observability, SIEM, and search, you can unify your data and accelerate incident responses.
Visit our QUAD page to learn how we can help safeguard your ICT environment. Let’s strengthen your defences today!
Latest News and Insights
PKI and Certificate Management the risk most miss.
An expired certificate can take down critical business services faster than many cyber attacks. With certificate lifecycles shrinking, PKI...
Read More
Data and Observability Pipelines
Observability pipelines have become a fashionable abstraction although by going down this route organisations are quietly re‑introducing the very...
Read More
Recon Partners with CrowdStrike to Elevate Cybersecurity for Australian Businesses
Recon has partnered with CrowdStrike to bring AI-powered cybersecurity to Australian businesses, delivering advanced threat detection and response through...
Read More
Google and M365 Security
Google and Microsoft offer great solutions for collaboration, yet the intricacies of these platforms need to be understood to...
Read MoreLooking to transform your cloud and cyber practices?
Recon transforms cloud and cyber from cost and risk into drivers of growth. Our focus is enabling scale, protecting value, and supporting confident business expansion.