When we think of cyber threats, we often think of hackers. However, people within your organisation can also cause damage. The Netherlands’ General Intelligence and Security Service (AIVD) warns about this ‘insider threat’ and offers practical tips in its new publication, Resilient against threats from within (Dutch).
According to AIVD intelligence research, foreign intelligence services, extremist groups, and criminal networks use insiders to steal confidential information or cause damage. This occurs in both the public and private sectors. But not everyone who causes damage within organisations does so deliberately. Think of employees, for instance, who accidentally click phishing links or leave documents on a train.
Getting started on preventing internal threats
The new publication by the AIVD offers insights and practical tips on how to deal with insider threats. Since the publication is currently only available in Dutch, we summarised its key insights and recommendations in English:
What is an insider threat?
An insider threat arises when someone uses their knowledge, access rights or position to cause harm to an organisation, either deliberately or unintentionally. This includes current and former employees, suppliers, contractors, visitors and interns.
The AIVD distinguishes between 6 types of insiders:
- Intentional: infiltrated insiders, self-initiated insiders and recruited insiders.
- Unintentional: unaware insiders, careless insiders and security-avoiding insiders. The last 2 types of insiders include employees who knowingly disregard security rules for convenience, but have no intention to harm their organisation.
Most insider incidents are unintentional, while deliberate actions tend to have a greater impact. Incidents also rarely happen out of the blue: personal circumstances, stress, and inadequate organisational responses can all contribute to the risk.
Common organisational vulnerabilities
The AIVD identifies several recurring weaknesses:
- Warning signs are not properly recorded or shared.
- Employees are reluctant to report suspicious behaviour.
- Awareness of insider threats is insufficient.
- Access rights are not regularly reviewed or updated.
- System activity is inadequately monitored.
- Remote workers and former employees can remain security risks.
How can organisations improve their resilience?
The AIVD recommends an organisation-wide insider risk programme, incorporating:
- Employee screening and regular rescreening.
- Clear access controls and separation of duties.
- Monitoring and logging of system activity.
- Training to recognise and report suspicious behaviour.
- Safe reporting channels and a strong security culture.
- Clear incident response and recovery procedures.
- Cooperation between IT security, HR, management and other relevant specialists.
The main takeaway
Insider threats are not just about malicious employees. Carelessness, lack of awareness and deliberate bypassing of security rules can also expose organisations to serious risks. Effective prevention therefore requires more than technical security measures: leadership, organisational culture and employee awareness are equally important.
- The AIVD bases its definitions of insider threats on those used by the UK National Cyber Security Centre (NCSC).
- How to raise awareness among employees? Keith Farzan shares his experience as CISO at the water authority Hoogheemraadschap De Stichtse Rijnlanden.
- For the original announcement of the publication ‘Resilient against threats from within’, visit the AIVD’s website (Dutch).
