Workplace Chaos and Uncertainty Stoke Insider Risk Warnings

Imagine laying off a senior developer after 12 years of employment, only to find that systems across the company crashed due to a “kill switch” he left behind.

See Also: Live Webinar | Reimagining Risk Modelling and Decisioning: Balancing Compliance and Automation for Competitive Advantage

This true story highlights the danger facing numerous businesses large, medium and small, as they endure multiple rounds of layoffs involving trusted insiders. U.S. government agencies too have been forcibly shedding many of their IT best and brightest. All of this adds up to increased risk from current and former employees who have the technology skills and enough of a grudge to take revenge, or who don’t mind selling out their employer.

“We expect insider threat will be a big challenge for CISOs this year,” said Allie Mellen, a Forrester analyst who helps information security professionals protect their enterprises.

“It’s a very tumultuous environment for job seekers and those who are employed right now. We have a lot of concerns about the insider threat risk increasing,” Mellen told Information Security Media Group. “There is more potential for insider threats this year than there were in years before, in part because a lot of companies are having layoffs. That will not only make people who were let go frustrated, but also potentially current employees too.”

For Ohio-based Eaton Corp., chaos struck in the form of kill-switch code named “IsDLEnabledinAD,” short for “Is Davis Lu enabled in Active Directory,” The code triggered after the company fired Davis Lu, a senior developer, on Sept. 9, 2019, and HR deleted his access rights from the Windows directory service, shows a recently unsealed federal criminal indictment against Lu.

A federal jury this month convicted him of causing intentional damage to protected computers. A sentencing date has yet to be set for the 55-year-old from Texas, who faces up to 10 years in prison. While the government didn’t name his employer, a local media reports said he worked for multinational power management company Eaton.

Lu’s case shows how trusted employees can go bad, especially when layoffs are at stake. “His internet search history revealed he had researched methods to escalate privileges, hide processes and rapidly delete files, indicating an intent to obstruct efforts of his co-workers to resolve the system disruptions,” said the Department of Justice. “Lu’s employer suffered hundreds of thousands of dollars in losses as a result of Lu’s actions.”

Probing Employee Betrayal

A number of data breaches already trace to insiders behaving badly, rather than simply making mistakes. To differentiate between the two, the annual Verizon Data Breach Report last year introduced the concept of the deliberate misuse of privileges, as opposed to more innocent or inadvertent types of human error.

Of the 30,458 real-world security incidents analyzed in the 2024 report, 897 of them, or 2.9%, involved privilege misuse – aka “employee betrayal” – with 854 of those incidents also featuring the confirmed disclosure of data. “Personal data is still the main targeted data type,” the report says.

The sometimes overlapping motivations seen in incidents involving privilege misuse in 88% of cases appeared to be financial, and in 46% cases to involve espionage, highlighting how the latter often relies on the former. In 6% of incidents, holding a grudge appeared to be the dominant factor, with ideology playing a part in 2% of breaches.

Some sectors see more privilege misuse than others. For the healthcare sector in particular, “insiders deliberately causing breaches have surged back into second place” – among leading breach causes – “after a steady decline since 2018,” the report says.

Clearly, there are times when corporate trust in an employee to keep the organization’s interests at heart break down. “Nobody wants to believe their employees will do them dirty, but if it happens, do you know how your organization would detect it? If you don’t, you’re not alone, and it may have already happened,” Verizon’s report says.

One frequent crunch point begins when employees are about to leave, and can continue even months afterwards. “A risk assessment is critical before, during and after the separation of the employee to minimize potential for an undesirable response,” says a U.S. Cybersecurity and Infrastructure Security Agency guide for federal agencies on managing the risk posed by “adverse or involuntary employee separations.”

Some situations pose greater risk than others. Retirements and voluntary resignations – not due to investigations or poor performance reviews – generally pose a low risk. Moderate risks include layoffs due to budget cuts or downsizing, or resigning due to impending investigations. High risks can include security incidents – including for sharing confidential information – as well as serious performance issues pertaining to incompetence, insubordination or attendance; and serious behavioral concerns including theft, substance abuse, sexual harassment, violence in the workplace, fraud and angry outbursts.

Security controls are a crucial malicious-insider defense. The CISA guide details a real-life incident from July 2022 in which “an employee with authorized access to a stand-alone government communications network used granted access to download and delete system security files.” Network security tools detected the activity, resulting in revocation of the employee’s network access and the employee being placed on administrative leave. While on leave, they “attempted to gain access to the government network by requesting a username and password exemption; the request was denied,” after which “the employee was then separated.”

Criminal Recruiters in the Workplace

A complicating factor with insiders is that they may get recruited by nefarious outsiders, including espionage agencies or unscrupulous competitors. Criminal groups, including ransomware operations, also claim to regularly make attempts to capitalize on unhappiness. LockBit was among the groups that pioneered advertising for enterprising insiders who want to provide remote access credentials in return for a significant cut of any ransom paid. Evidence also suggests ransomware operations actively approach insiders.

“A lot of times it’s not even the intention of an employee who has been slighted to become an insider threat, but cybercriminals can sway them in that direction,” Forrester’s Mellen said. “If a cybercriminal reaches out to them and says: ‘Hey, if you’re frustrated, you can make some money if you start working with us and providing us with some data,’ it can be tempting and, in some ways, feel like a victimless crime.”

Times of uncertainty can create more fertile ground for social engineers. “Security leaders need to appropriately prepare to not only protect the company but also protect the employees themselves,” Mellen said.