Insider threat via email: Signs, signals, and prevention

Every organization has sensitive data stored in their emails and servers, and guarding them with the right security measures is of utmost importance. However, beyond these protective measures, certain attacks can penetrate and cause chaos within the organization's systems. While most of these attacks can be detected with the right measures in place, certain threats work from within the company. 

These threats can cause more damage than external threats because threats that emerge from within have a higher chance of accessing confidential data. This data has the power to affect a company's cybersecurity posture and disrupt its normal functioning, making it more serious and severe. They’re most commonly propagated by employees who are part of the organization and can get their hands on important data. 

Handling such attacks takes continuous monitoring and early detection of signs by the company's IT administrators. In this article, we’ll take a look at what insider threats are, the types of threats to be vigilant for, and the detection and protection measures organizations can take to protect their data. 

What are insider threats?

Insider threats are cyber threats in which an employee or other members of an organization, such as vendors or partners, misuse their authorized access to perform certain activities that could harm the company. These threats can be propagated in multiple ways. The insider may leak sensitive data to external members as part of corporate espionage, or they may inject malware into the systems and even lure data like credentials from other employees of the company. 

Insider threats pose serious risks to the company because the threat actor acts from within to bring about the attack. They have the means and methods to access all business-critical information. This makes insider threats one of the most feared attacks for organizations. In 2024 alone, 83% of organizations have reported insider attacks. 

Any organization that stores business-critical data can be a victim of an insider threat. This includes financial organizations, healthcare companies, organizations from the manufacturing and pharmaceutical sectors, and most importantly, government bodies and agencies. Important national finances, security data, and regulations are present within the digital infrastructure of government bodies, making it a prime target. 

Types of insider threats

To understand insider threats and successfully prevent one from happening in your organization, it's important to differentiate between the means and intent behind the attacks.

Malicious insiders

Malicious insiders are employees or others with access to the system who carry out an attack with a malicious intent. They’re either influenced by someone who promises a reward in return for their attack, or it could be a disgruntled employee who wishes to bring down the organization. It could even be someone who was fired from the company or someone who feels they've been wronged by the company. 

These employees actively seek out ways in which they can gain access to information, download sensitive files, and share them for monetary gains or even blackmail their employer with this data. 

Negligent insiders

Negligent insiders are employees who let an insider attack take place due to their lack of awareness or knowledge. These employees don't have any malicious intent, but they're not careful enough to take the necessary steps to preserve their account or the data that's in their control. Because of their lack of safety, there's a higher chance of human error, making it easy for threat actors to penetrate systems through their access. 

Some examples of negligent insider threats include an employee clicking on a phishing link or an attachment in an email, accessing sensitive data through public WiFi networks, and not using secure passwords for their accounts.

Compromised insiders

Compromised insiders are employees whose accounts or access to the company's systems or data has been taken over by a threat actor. In these types of attacks, the compromised individual is rarely aware of the breach, and they go about having conversations with their colleagues as usual. The threat actor either silently monitors these conversations to gain insider information, or they participate in the conversation under the pretext of the original sender. 

Account takeover attacks fall under the category of compromised insider threat attacks. These attacks are dangerous because other employees go about sharing vital information with the compromised account without knowledge of the ongoing attack. Because the original owner is unaware, important access and authorizations aren’t revoked. 

Why are insider threat attacks successful?

Insider threats are more successful compared to external cyber threats because they have a unique advantage over them. The most common reasons attributing to this success are:

• They have a level of access within the company that other external hackers can never have.
• There's a trust factor associated with every employee an organization hires, making these attacks less conspicuous.
• A company's employees know where to look for sensitive information, reducing the time and effort needed for a data breach.
• Owing to the trust employers have in their employees, they fail to enforce sufficient policies and access controls, leading to easy data access for employees.
• Insider attacks build over time. They gradually collect valuable information. These attacks are difficult to detect because insiders accessing information is a natural part of business operations. This delays remediation and helps the threat actor progress the attack faster.

Indicators of insider threat attacks

Insider attacks gradually extract data from the organization's repositories. While it's difficult to detect them at first, there are certain indicators that you can monitor regularly. A combination of some or all of these factors will help protect your organization. 

A surge in network traffic

In some insider attacks, the employee extracts the sensitive data by themselves, and in some cases, they create loopholes in the security infrastructure or inject malware so that external threat actors can access the company's network. In such cases, admins can detect increased activity from external factors with an obvious increase in network traffic. The right monitoring systems can detect these anomalies, so that admins can investigate further.

Suspicious access times and locations

An organization's IT admins can monitor login times and locations of their employees' accounts. It's a good practice to keep an eye on this data to determine any unusual patterns. If an insider is performing any malicious activity, they're most likely to do this at odd hours outside of office hours. While not all late-night logins are a subject of concern, this coupled with other suspicious activity can alert the admins. 

Certain insider threats may also progress through an outsider gaining access and logging in from different locations. If the admin knows the usual login location of a user but notices a discrepancy, they can investigate it.

Unwarranted information requests

Every organization should have clearly defined information access roles. Based on their role and the level of authorization, this can differ among employees. If you spot an employee requesting access to data they may not need to access, be wary. Across the organization, alert your employees to be mindful when sharing resources with other employees. Exercising caution from the beginning ensures that sensitive information doesn’t end up in the wrong hands. 

Unauthorized software installation

In many insider threat attacks, the threat actor installs malicious software on the system to affect the organization’s devices and networks. IT admins can prevent these installations by setting up strict policies depending on the role and seniority of their employees. With the right mobile device management tools in place, admins can monitor all app installations and prevent any apps that may have a malicious intent from being installed. If you notice an employee installing such apps, be cautious and monitor their actions to see if you notice any other warning signs. 

Unusual data downloads

While it's dangerous if an employee with malicious intent is privy to sensitive information, the actual value for them lies in getting a copy of this data to use for their benefit. Threat actors usually do this by downloading and exporting a copy of sensitive data because they never know when they'll lose access to it. Monitor high-volume data downloads by deploying the right applications for the email provider as well as the security solution.

Use of external storage devices

Another way insiders take over sensitive data is by transferring files to an external storage device, such as a flash drive or a hard drive. Through in-depth behavioral analytics to spot high-risk users, admins can block their ability to connect external storage devices to their business laptops. This will prevent any unwarranted data transfer, keeping your organization's data secure within your infrastructure. 

Preventing insider threat attacks

Insider threat attacks can be prevented by taking a few precautions and paying attention to the warning signals. Let's take a look at the steps organizations need to take. 

1. Develop a security culture

Every organization needs to have a robust security culture and its employees on board with their plan. This ensures that secure practices are followed throughout the company so that there's a minimal chance of data breaches or leaks. Educating employees about the repercussions of such attacks and explaining how their business and clients will be affected gives them an essential reality check. Let them know that security has to be at the core of all their processes and actions. This will help reduce the possibility of negligent and compromised insider threats.

2. Define strict email policies

Without strict policies surrounding an organization's email systems, data is free to flow outside the company. To make sure your company isn’t a victim of such a situation, configure strict policies for different sets of users and enforce them to prevent sharing of sensitive data outside. You can have different policies for regular employees, interns, contract employees, and vendors, giving them just the level of access that's needed to complete their tasks. 

3. Set up monitoring systems

Insider attacks always leave certain signs for admins. Spotting these signs early on helps reduce the impact of the attack. Setting up the right analytics, dashboards, and threat reports for different layers of the organization helps. These systems can issue an alert when there's suspicious activity in any of the company's entities. The admin can investigate further, analyze the root cause, and nip it in the bud if it's malicious in nature. This includes erratic network or email traffic, a high volume of downloads, and unauthorized software installations. 

4. Enable role-based access

Every employee in a company has a role to play. Based on the department, role, and seniority of each employee, the admin has to provide access only to the functions that are essential to their role. This includes document access and the authorization to perform money transfers on behalf of the company. Providing role-based access also applies to admins because they have the power to overlook all of the roles and permissions. Having separate admins for different functions and categorizing them clearly helps avoid any misdemeanor. 

5. Terminate inactive accounts

Every organization comes across the unfortunate situation where they have to fire employees. Not every employee who is let go takes it well. Some can be vengeful and bring down the company. This also applies to certain employees who quit due to a difference of opinion with the organization. Ensure all user accounts are promptly handled as soon as the employee leaves the organization. This can be handled either by archiving important data and closing down the account, or changing the password of the account to ensure the user doesn't log in anymore. 

6. Conduct audits regularly

There's a certain process that every organization has to go through while preparing for audits. In this process, many loose threads and non-compliance issues come to light. It's important to look for such factors regularly and carry out remediation measures. Auditing the important actions that have taken place in an organization's email and file-sharing portals will also shed light on any suspicious activities carried out by certain employees. 

7. Set up authentication checks

SPF, DKIM, and DMARC are email authentication mechanisms that can point out if any tampering has occurred while the email was in transit. Set up these authentication checks for your organization to ensure your emails don't end up in the wrong hands. Internal threat actors may even make use of the unavailability of such mechanisms for their benefit and pass this on to other threat actors. Having these mechanisms configured adds an extra layer of protection to your organization's emails.

8. Deploy a DLP service

Data leak prevention (DLP) prevents an organization's sensitive data from being shared intentionally or accidentally to members who aren’t authorized to access it. Organizations can define specific policies that take into account the data that's important to their company and configure relevant actions. This keeps the sensitive data within the organization, making sure only the right members can view and access it. Admins can also monitor these violations to determine if there's a malicious insider at play.

9. Conduct awareness sessions

While some employees make calculated moves to put their company at risk, for some, it's just a matter of negligence. Conducting periodic sessions to educate them about what security perils to be wary of and how to tackle any incoming threats helps them be more aware. Every employee should be introduced to the company’s security practices and the latest trends in cybersecurity. This will help them identify any incoming threats and alert them about the repercussions that the company may have to deal with in the event of a breach. 

10. Secure your email accounts

With the amount of sensitive data stored within a company's emails, protecting it is one of the first steps a company needs to take. Email security solutions allow you to keep an eye on all of the activities that are going on in your email systems. You can view any possible threats, anomalies, and malicious attempts within the email security provider. These reports give you the much-needed visibility to see if something deviates from the baseline so you can take action accordingly. 

eProtect is a cloud-based email security and archiving solution that provides an additional layer of security for email accounts. The solution offers advanced threat detection mechanisms that can secure on-premise and cloud email accounts from evolving email threats. eProtect is the security solution powering Zoho Mail, a platform trusted by millions of users.