Insider Threats and Supply Chain Risks

Insider Threats and Supply Chain Risks

What Is an Insider Threat?

An insider threat originates from someone who already has authorized access to an organization's systems, networks, or data. That person may be a current employee, a former employee whose credentials were not revoked, a contractor, or a business partner. Because insiders start inside the perimeter, many traditional security controls — firewalls, intrusion-prevention systems, and perimeter monitoring — are less effective against them.

Security professionals classify insider threats into three main types:

• Malicious insiders intentionally steal, leak, sabotage, or misuse data or systems for personal gain, revenge, ideology, or because they have been recruited by an outside actor (the term for this is a turn). Edward Snowden's 2013 disclosure of classified NSA documents is a widely cited example of a malicious insider with elevated privileges acting deliberately.
• Negligent insiders cause harm through carelessness — clicking a phishing link, misconfiguring a cloud storage bucket, or emailing sensitive files to a personal account. They have no harmful intent, but the outcome can be as damaging as a deliberate act.
• Compromised insiders are employees whose credentials or devices have been taken over by an external threat actor, so the attacker moves laterally through the network while appearing to be a legitimate user.

Why Insider Threats Are Hard to Detect

Insiders use legitimate credentials and often operate within the boundaries of their normal job duties — at least initially. Detection gaps typically include:

• Lack of user behavior baselines. If nobody has established what normal looks like for a user, anomalies go unnoticed.
• Excessive privilege. When users have access to far more data than their job requires, the blast radius of any misuse is enormous. The principle of least privilege (PoLP) is the primary countermeasure.
• Poor offboarding processes. Accounts that are not disabled promptly after termination allow former employees to retain access.
• Insufficient logging. If file access, database queries, and email transfers are not logged and reviewed, investigators have nothing to analyze after an incident.

NIST SP 800-53 provides the authoritative catalog of security and privacy controls that address these gaps. Relevant control families include AC (Access Control), AU (Audit and Accountability), and IA (Identification and Authentication).

What Is a Supply Chain Attack?

A supply chain attack targets the less-secure elements in the network of vendors, developers, hardware manufacturers, or service providers that an organization depends on, rather than attacking the organization directly. The attacker compromises a trusted third party and then uses that trust relationship as a vehicle to reach the ultimate target.

The 2020 SolarWinds Orion compromise is the most widely studied modern example. Attackers inserted malicious code into a legitimate software update that was then distributed to thousands of SolarWinds customers, including US federal agencies. Because the update was digitally signed and came through a trusted update channel, most security tools did not flag it.

Supply chain entry points include:

• Software updates and build pipelines — injecting malicious code before it is signed and distributed.
• Hardware tampering — modifying firmware or physical components before delivery.
• Third-party service providers — using a managed service provider's (MSP's) access credentials to pivot into customer environments (as seen in multiple MSP-based attacks).
• Open-source dependencies — inserting malicious packages into repositories that developers pull automatically (sometimes called dependency confusion or typosquatting).

Mapping Supply Chain Attacks to the Kill Chain

Lockheed Martin's Cyber Kill Chain describes seven stages of an attack: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Supply chain attacks often compress or disguise the Delivery and Exploitation stages because the malicious payload arrives through a legitimate, trusted channel. Understanding which kill chain stage a control interrupts helps security teams prioritize spending and effort.

Recommended Controls

For insider threats (NIST SP 800-53 references):

1. Least privilege and role-based access control (AC-6, AC-2) — Grant users only the permissions their current role requires; review access quarterly.

2. User and Entity Behavior Analytics (UEBA) / continuous monitoring (AU-6, SI-4) — Establish behavioral baselines and alert on anomalies such as large file transfers, off-hours logins, or access to unusual data sets.

3. Separation of duties (AC-5) — Require more than one person to authorize sensitive actions such as wire transfers or privileged account changes.

4. Prompt account termination and access revocation (PS-4, AC-2) — Disable all accounts on the employee's last day, not days or weeks later.

For supply chain risks (NIST SP 800-161 references):

1. Supplier risk assessments and contract requirements (NIST SP 800-161, C-SCRM practices) — Evaluate vendors' security posture before contracting and include security obligations in agreements.

2. Software Bill of Materials (SBOM) requirements — Require vendors to provide an inventory of all software components so you can assess exposure when a component is found to be compromised.

3. Update integrity verification — Verify cryptographic signatures on all software updates before deployment, and use a separate verification mechanism from the vendor's own channel when possible.

4. Network segmentation and zero-trust architecture — Limit what third-party tools and service accounts can reach on your network, reducing the blast radius if a supplier is compromised.

Safety and Professional Responsibility

Insider threat programs must be designed carefully to comply with applicable privacy law and labor regulations. Monitoring employees without a written, communicated acceptable-use policy can expose an organization to legal liability. Always involve legal counsel and HR when designing insider threat detection programs. Document all investigative steps; chain of custody matters if evidence is ever needed in legal proceedings.