Malicious Insiders

A deliberate internal threat comes from somebody who already has — or once had — a legitimate reason to be on the system: a member of staff, a contractor or a temporary worker who chooses to cause harm or to gain from it. This may be someone who feels unfairly treated, or simply someone who sees a chance to make money. An accident, such as pressing the wrong button, is not a deliberate threat, because nobody meant the damage to happen. The weak point is often access: an account left open when a contract ends lets a person carry on after they have gone.

Destroying records and stealing money

An insider can delete or alter records far more easily than an outsider, because they know which files matter. A warehouse supervisor might delete or change delivery records after stealing stock, so the missing items cannot be traced. Money is just as easy to take: someone with payroll access can add a fake employee and have the wages paid into an account they control.

Stealing or leaking information

Copying information and taking it out of the organisation is another internal threat. It can continue for months because the insider is allowed to open the files. People do it for cash, to get back at a manager, or to support a political or social cause. Selling trade secrets to a rival business is industrial espionage, and the insider often gains money or a job from it. The result is the same: confidential information ends up with someone who should never have had it.

Malware from an internal source

Malware introduced from an internal source can collect confidential information and send it outside the organisation. A staff member with access to a shared computer could install a small program that copies every file in the finance folder to an online storage account they control. Because the machine is inside the network and the program runs under a normal staff login, the traffic can look ordinary, so a firewall on the internet connection does not stop it.