Posted by
Share this article
How Organisations Can Mitigate Insider Threats With the Essential Eight
Cybersecurity threats are evolving fast and among the hardest to deal with are insider threats—threats from people inside the organisation. Whether intentional or accidental these threats are a big risk to data, infrastructure and overall security. For decision makers in large organisations and government, understanding and mitigating insider threats is critical to having strong cybersecurity. The Australian Cyber Security Centre’s Essential 8 (E8) Maturity Model, ranging from maturity levels zero to three, provides strategies that will help protect your organisation against the insider threat risk.
What are Insider Threats?
Insider threats occur when someone inside the organisation misuses their access to breach security. This can be employees, contractors or partners.
Types of Insider Threats
Malicious Insiders: These are people who intentionally use their position to harm the organisation. The Australian Cyber Security Centre (ACSC) defines malicious insiders as “employees, former employees, contractors or business associates who have legitimate access to your systems and data, but use that access to destroy data, steal data or sabotage your systems.”
Negligent Insiders: Often threats come from accidental actions such as clicking on phishing links or not following cybersecurity protocols.
Compromised Insiders: Attackers can gain access to an organisation’s systems by exploiting an employee’s credentials, most typically through phishing.
Why Insider Threats Are a Big Problem
As Ashur Williams, Essential 8 technical lead, said during a recent webinar, "Insider threats aren’t always malicious but sometimes they are, and they’re one of the big threats (to environments)."
Organisational environments are more diverse and wide-reaching than ever with cloud storage and remote work, creating a greater surface area for vulnerabilities. Advanced Persistent Threats (APTs) which can be facilitated by insider negligence or malice can sit inside an organisation for months undetected.
How to Mitigate Insider Threats with the E8 and Beyond
1. Role-Based Access Control (RBAC) - E8 Strategy 4
Limiting access to sensitive data is the first step. By implementing RBAC employees only access the systems and information they need for their role, reducing the opportunity for exploitation.
2. Limiting Administrative Privileges - E8 Strategy 4
Reducing the number of admin accounts reduces the scope of insider damage. As Ashur Williams said, "When you restrict admin privileges you reduce the risk of misuse of those accounts."
3. Multi-Factor Authentication (MFA) - E8 Strategy 3
MFA adds an extra layer of security, so even if credentials are stolen, access is unlikely. As mentioned during the webinar, implementing MFA across internal and external systems will help stop most insider breaches resulting from stolen credentials.
5. Regular Audits and Monitoring - E8 Maturity Level 2&3
Organisations should review access logs, unusual activity and employee behaviour regularly to look for red flags. As Williams touches on in the webinar, centralised monitoring systems are essential for real-time anomaly detection, and are a requirement for organisations seeking to attain maturity levels two and three of the E8 Maturity Model.
5. Employee Training
Awareness programs educate employees to recognise and respond to phishing, social engineering and other tactics used by cybercriminals. Proactive education reduces the risk of accidental threats.
What to Do Now
Implement the Essential 8: The guidelines developed by the ACSC provide practical ways to mitigate cybersecurity risks including insider threats. It covers areas such as patching, MFA and limiting administrative access.
Get Cybersecurity Tools: Solutions like Security Information and Event Management (SIEM) systems will track and monitor user activity.
Create a Security Culture: Leadership buy-in is key. By making security a priority, organisations can encourage proactive behaviour from employees.
How Tesserent Can Help
Insider threats are a growing problem but with the right strategies organisations can protect their data and infrastructure. If you’d like to investigate an Essential Eight Maturity Uplift, the experts at Tesserent can help. Our dedicated E8 team can help roll out compliant strategies that defend your organisation from insider threats while uplifting overall cybersecurity. Get in touch today for a consultation.
Upcoming Events
A webinar in January to unpack the annual updates to the Essential Eight model.
Essential Eight training in January 2025 through ALC.
Contact us
Speak with a Tesserent
Security Specialist
Tesserent is a full-service cybersecurity and secure cloud services provider, partnering with clients from all industries and all levels of government. Let’s talk.
