Careless costs the same as malicious

The employee who was never an employee

A category arrived in the last two years that the vocabulary does not accommodate. Somebody applies for a remote technology role, interviews well, provides references that check out, signs a contract, receives a laptop and is paid a salary. They are also working on behalf of somebody else, and the salary is a secondary objective rather than the point.

The scale is no longer marginal. Fraudulent remote technology workers reached around 5% of investigated incidents in one large body of casework, and activity of that kind rose roughly 220% year on year in another. The economics are obvious once stated: hiring is cheaper than intrusion, produces better access than any exploit, and is entirely legal until the moment it is not.

It dissolves the distinction the whole subject is named after. An insider is supposed to be somebody who was trusted and then betrayed that trust; this is somebody who obtained the trust in order to use it, which is an outsider by motivation and an insider by every technical measure your controls can see. Nothing in an access review distinguishes them, because their access is correct.

Which puts the detection where security teams cannot reach. The signals are in recruitment: reluctance to appear on camera, an address that does not match the tax record, equipment shipped somewhere other than the stated home, patterns of work that fit a different time zone, an unusual sequence of employers with no overlapping colleagues. Every one of those belongs to somebody in human resources, and in most organisations nobody has ever asked them to look.

The leaver process everybody has and nobody finishes

Every organisation of any size has a documented offboarding procedure, and almost none of them are complete, for a reason that has nothing to do with diligence. The procedure works from a list, the list comes from the central directory, and a substantial part of the modern estate never entered the central directory. The extreme case is the credential that never had a joining date either, which is a problem of ownership rather than of departure.

The gaps are consistent enough to be predicted. Services bought by a department on a card, which nobody in technology knows exist. Access granted directly to a person rather than through a group, which disappears from view the moment the person who granted it moves on. Shared credentials known to four people, where disabling an account changes nothing because the password is the account. And whatever the person set up themselves to do their job, which is frequently the thing they were praised for.

The fix is unglamorous and it is a project rather than a policy: reconcile what is being paid for against what is in the directory, at least annually, and treat every service that appears on an invoice and not in the list as a finding. Most organisations that do this once discover between a tenth and a third of their software estate was invisible, and the discovery is worth more than the offboarding improvement that prompted it.

There is a second half nobody schedules. Somebody has to check afterwards — a fortnight later, from the outside — whether the departed account can still reach anything. It takes an hour, it is the only step that verifies rather than asserts, and in practice it is the step that gets dropped when the next leaver arrives.

What about the one who was used?

The third category in the serious research is neither careless nor malicious, and it is the one most likely to be misfiled as either. Somebody's access is used against their employer without their agreement: a session stolen from their machine, a helpdesk deceived into resetting their factor, or the person themselves manipulated into performing an action they believed was legitimate.

From the logs it is indistinguishable from a deliberate act, which is why the investigation matters more here than anywhere else in this subject. An organisation that concludes too quickly will discipline somebody who was deceived, which is unjust and also expensive, because everybody else watching learns that reporting a suspicion is dangerous.

The remedies are the ones that do not depend on the person being reliable. Factors that cannot be relayed to somebody else. Sessions that expire rather than lasting a month. Limits on what a single account can reach, so that a compromised identity yields a department instead of an estate. Every one of those also helps against the other two categories, which makes them the best value in the entire subject.

And it argues for a particular tone. A workforce told that they are the last line of defence, and that vigilance is their responsibility, will conceal the moment they fail — and they will fail, because the deceptions are good. A workforce told that the systems are built to survive their mistakes reports faster, which is the single variable that most reliably reduces what an incident costs.

The controls that pay for themselves

Almost every large internal loss shares a precondition: somebody who needed one system could reach forty. Narrowing that is the highest-value work available here and the least likely to be funded, because it produces no artefact, appears in no report, and its success is measured by things that did not happen.

Start with the data rather than the people. Find where the material that would actually hurt lives, which is usually fewer places than expected and never only the places the policy names. Then establish who can reach it today, which will produce an unpleasant number, and reduce that number until somebody complains. The complaint is the signal that the exercise reached the useful part.

Second, make the safe path the easy one. People email files to themselves because the sanctioned way of working from home is slow; they use personal storage because the approved service will not open on a phone. Every one of those is a design decision presenting as a discipline problem, and fixing the design removes a whole class of incident without anybody being trained about anything.

One caveat belongs on all of it. Every figure quoted here comes from surveys of organisations that were willing to describe their own losses, which selects for the larger and better-instrumented — a company with no logging cannot report an incident it never detected. The likely direction of the bias is comforting in one respect and alarming in another: the averages are probably inflated by the presence of expensive estates, and the frequencies are almost certainly understated everywhere else, because an unnoticed disclosure is indistinguishable from an uneventful year. Both distortions argue the same way: treat the averages as an order of magnitude rather than a budget line, and treat the frequencies as a floor. The honest reading of any survey in this field is that it describes the organisations capable of noticing, and that capability is unevenly distributed by size, sector and regulatory obligation. A hospital, a haulage firm and a hedge fund do not appear in such research in proportion to how many of them exist, and the resulting portrait flatters whoever already had the instrumentation.

A fourth deserves mention because it costs an afternoon and is almost never done: rehearse a departure that has gone wrong. Take a real leaver from six months ago, pretend the organisation later suspects them, and try to answer the questions an investigation would ask. What did they reach in their final fortnight? Which subscriptions were in their name? Did anybody verify, afterwards, that the accounts closed? Most organisations discover within an hour that they cannot answer any of the three, and the exercise produces a specific list of gaps rather than the vague unease that a policy review generates.

Third, and last because it is the one everybody starts with: keep records that would let you answer the question afterwards. Not surveillance of individuals, but logs of who reached what, kept long enough to cover a departure that becomes interesting two months later. It is the cheapest thing on this list, the least contentious, and the one most consistently discovered to be missing at the exact moment it is needed.