Palo Alto Networks sets out insider threat risks and safeguards

What happened

Palo Alto Networks says insider threats can evade traditional security checks by using legitimate account access, in an undated guide published on its Cyberpedia website.

The company’s explainer, the source for this report, describes how employees, former staff and contractors can put organisational information and systems at risk. It is security guidance, rather than an account of an arrest, prosecution or specific breach.

The guide covers both intentional harm and accidental misuse of access. It identifies unauthorised viewing of information, disclosure to people without permission and installation of malicious software as ways that trusted access can become a security problem.

The background

Palo Alto Networks groups insiders into three categories: people who deliberately misuse an existing position, those who cause harm through carelessness, and people who join an organisation intending to undermine it. The distinction matters because the circumstances behind an incident affect which safeguards may help prevent it.

Deliberate misuse can involve stealing confidential material or disrupting systems. The guide lists money, personal grievances, espionage and ideological motives among the reasons someone might abuse their access.

Accidental incidents have a different starting point. An employee might respond to a phishing message designed to trick them into revealing information, configure security settings incorrectly or send confidential material to someone who should not receive it.

The third category, which the guide calls moles, involves people obtaining employment, contracts or other legitimate positions as a route into an organisation. According to the company, they may act for competitors, governments or criminal groups to obtain information or disrupt operations.

Terminology varies across security guidance. Insider Threat Roundup’s earlier report on DTEX’s distinction between insider risk and insider threat described an approach that separates accidental exposure from intentional harm. Palo Alto Networks uses insider threat more broadly in its detailed explanation, including unintentional actions.

The potential damage also depends on the account involved. System administrators, network engineers and database administrators may be able to alter configurations, install programs and change other people’s permissions, giving misuse of their accounts consequences beyond access to a single file.

An apparently legitimate session does not necessarily mean the account holder is responsible. The guide explains that attackers who obtain usernames and passwords can impersonate users; credentials can be stolen through deception, exposed in breaches or obtained through repeated password-guessing attempts.

Data exposure is not confined to one channel. The company describes information leaving through email, cloud storage, removable media or stolen devices. This focus on where information goes also features in Mimecast’s guidance on detecting insider-related data exposure, which examines file movements and account activity.

What people are saying

Palo Alto Networks recommends combining technical restrictions with measures aimed at employee behaviour. Its guidance links access controls, security audits and checks for unusual activity with staff training and background screening, rather than presenting any one measure as a complete defence.

The company says employee monitoring can include examination of emails, internet use, applications and patterns of activity. It also says organisations need to balance security requirements with employee privacy, explain their monitoring practices and comply with relevant privacy rules to protect trust and avoid legal problems.

For cloud environments, the publisher describes data detection and response, or DDR, as a way to analyse activity records as changes occur. Examples include information moving from encrypted storage to an unencrypted location, or into a geographical location that creates concerns about the rules governing where data is held.

According to the guide, this analysis assesses whether use of an account’s permissions is appropriate or presents a risk, such as an attempt to remove information without authorisation. The company presents it as a means of examining what happens after access has been granted.

Palo Alto Networks contrasts this ongoing monitoring with data security posture management, or DSPM, which it describes as a more static assessment of data risk. Its position is that using both approaches gives organisations a fuller view than relying on either alone.

What happens next

For organisations applying the guidance, reviewing permissions is one practical starting point. The company recommends least-privilege access: giving users only the permissions needed for their work, then reviewing and adjusting those permissions regularly.

Privileged accounts also need stronger sign-in protection, according to the guide. It recommends multifactor authentication, which requires more than one form of verification, alongside clear password-management policies and education about phishing risks.

User behaviour analytics offers another layer of detection. The guide describes tools that use statistical analysis and machine learning to establish typical patterns, including login times, application use and file access, then flag departures from those patterns for investigation or an automated response.

Those tools depend on usable activity records. Palo Alto Networks recommends maintaining comprehensive logs and integrating behaviour analysis with existing security systems. Its guidance treats unusual activity as an indicator of a possible problem, rather than proof of deliberate wrongdoing.

To reduce accidental disclosures, the company recommends data loss prevention tools and automated security checks alongside training. It also advises classifying information according to its sensitivity and encrypting it both while stored and while being transferred.

Written policies need to cover how incidents will be handled as well as how access is granted. The guide says organisations should document, communicate and enforce their rules, reviewing them regularly as threats change. Security audits provide a further opportunity to find weaknesses and address them before information is exposed.