The Enemy Within: Lessons on Insider Threats from Investigations and Programs

What was once considered a novel risk from a disgruntled, tech-savvy employee is now commonplace. Complex outsourcing arrangements, remote workers, AI-assisted tools, and the ever-increasing value of intellectual property and other confidential and classified data contribute to increase the attack surface, the number of potential insider threats, and incentives for an insider attack. Recent examples include North Korean remote workers, the Coinbase attack, and leading technology companies’ accusations of data theft. This session discusses examples of common types of insider attacks and threat actors and techniques to identify the associated user behaviors. Panelists will discuss experiences coordinating IT, HR, privacy, legal, and other stakeholders together to shape insider threat programs and investigations.