Detecting and mitigating insider threats in cloud services
Insider threat is a concept where an authorized employee (that is, an insider) performs an action (either maliciously or accidentally) that they are not supposed to. Some common consequences of insider threats are as follows:
- Loss of data
- Data leakage
- System downtime
- Loss of company reputation
- Monetary loss due to lawsuits
Some common examples of insider threats are as follows:
- An administrator clicks on a phishing email from an unknown source, and as a result, a file server gets infected by ransomware, and all the files are encrypted.
- An employee with the privilege to access an accounting system leaves their laptop unattended and an unauthorized person takes over his laptop and steals customer data.
- A sub-contractor with access to databases with customer email addresses exports customer data and sells it on the dark web.
- An administrator with access to backup files decides...
