The malicious insider: when the threat already has a login

What drives them

• Grievance: a passed-over promotion, a dispute, a dismissal.
• Money: selling data or access, or committing fraud.
• Coercion or recruitment: criminal groups have openly advertised for insiders at large companies and telecommunications providers, offering payment for access.
• Taking work with them: customer lists and designs that "belong to me" on the way to a competitor.

When the risk peaks

The dangerous windows are predictable: resignations, terminations, disputes, restructures, and the weeks after someone has left. In one well-documented case, a former Cisco employee used access that still worked months after he resigned to delete hundreds of virtual machines, taking down a service for thousands of customers. He was prosecuted. The lesson is about the access, not the person.

Effort to defend: high, but the controls are ordinary

You can't make people trustworthy with technology. You can make sure one person's worst day is survivable:

• Least privilege: people get the access their job needs, and no more. Review it when roles change.
• Separation of duties: no one person can both set up a new supplier and approve its payment, or both change a record and approve the change.
• Offboarding the same day: access removed before, or as, someone is told. Shared passwords changed. Keys, tokens and remote access revoked. A checklist, not memory.
• Logging you actually look at: unusual bulk downloads, access at odd hours, data copied to personal email or USB.
• Backups the insider can't delete: separate credentials, with offline or immutable copies.
• Treat people well. Fair process, clear expectations and a way to raise grievances reduce the motive, which is the one thing a technical control can't touch.