Skip to content
Neutron Computing

Insights

The accidental insider: good people, honest mistakes

For most organisations the biggest risk isn't a criminal mastermind. It's a well-meaning person having a busy day. Accidental insiders aren't careless people; they're normal people in systems that make the risky option the easy one.

Common mistakes

  • Sending to the wrong person. Email autocomplete picks the wrong "Sam".
  • Weak or reused passwords. One leak elsewhere unlocks your work account.
  • Clicking under pressure. Urgency pushes us into fast, automatic thinking.
  • Oversharing files. "Anyone with the link" on a sensitive folder.
  • Shadow IT. Using personal apps or AI tools for work data without thinking about where it goes.
  • Plugging in USB devices:
    • Found or gifted USB drives can carry malware. Attackers have deliberately left drives in car parks to see who plugs them in.
    • Not every USB device is what it looks like. A cable or "drive" can act as a keyboard and type commands the moment it's connected.
    • Public charging ports and borrowed cables can be a risk for phones and laptops. Use your own charger and a power point instead. The FBI and FCC have warned about this; it is precautionary advice, and no confirmed cases have been published.
    • Personal USB drives are an easy way for work data to walk out the door, or for infections to walk in.

    Even a USB cable can be malicious. Most people know not to plug in a USB stick they found, but cables look harmless. They don't have to be. A leaked NSA catalogue, published by Der Spiegel in 2013, listed bugging devices disguised as normal USB plugs that could send and receive data by radio. Today, cables like the O.MG Cable are sold openly for security testing. They look identical to a normal charging cable, yet contain a tiny radio and computer that can type commands and record keystrokes. When engineers CT-scanned one in 2024, the hidden chip was invisible from outside. Criminals use the same technique: in 2022 the FBI warned that the FIN7 gang was posting USB devices to businesses, disguised as gifts, that acted as a keyboard and installed malware giving the attackers a way into the network. Use cables and chargers you bought from a reputable source, and never use one that arrives unexpectedly or that someone leaves lying around.

How to reduce it, without blaming people

  • Make the safe way the easy way: shared drives instead of USB sticks, a password manager instead of memory, and USB storage turned off on devices that don't need it.
  • Add guardrails: warnings for external email recipients, a short delay before emails actually send, and approval for payments and bank detail changes.
  • Set clear, simple rules: "Never plug in a USB device you didn't buy or weren't given by IT."
  • Make reporting safe: people who report a mistake quickly should be thanked, not punished. Early reports turn incidents into near misses.
  • Keep training short and regular: five minutes a month beats a two-hour annual session.

Sources