Ponemon Institute & DTEX Report Reveals Organizations Are Missing the Indicators of Insider Threats

DTEX Systems, the Workforce Cyber Intelligence & Security CompanyTM, today released a new report, The State of Insider Threats 2021: Behavioral Awareness & Visibility Remain Elusive, which revealed that organizations struggle to identify the indicators of insider attacks.


Released in conjunction with the start of National Insider Threat Awareness Month, the report, conducted by the Ponemon Institute with sponsorship from DTEX, surveyed a global pool of 1,249 IT and IT security practitioners and found that 53% of companies find it impossible or very difficult to prevent an insider attack when data is being aggregated, a key indicator of intent of an attack. “The vast majority of security threats follow a pattern or sequence of activity leading up to an attack, and insider threats are no exception,” said Dr. Larry Ponemon, Chairman and Founder, Ponemon Institute. “Many security professionals are already familiar with Lockheed Martin’s Cyber Kill Chain and the MITRE ATT&CK Framework, both of which describe the various stages of an attack and the tactics utilized by an external adversary. Since human behavior is more nuanced than machine behavior however, insider attacks follow a slightly different path and, therefore, require modern approaches to combat.”


Over the course of thousands of insider threat investigations and incidents, DTEX’s Counter-Insider Threat Research analysts have identified the insider equivalent of these frameworks: the Insider Threat Kill Chain, which encompasses the five steps present in nearly all insider attacks: Reconnaissance, Circumvention, Aggregation, Obfuscation and Exfiltration. To fully understand an insider incident, DTEX finds that visibility into the entire kill chain — not just one or two steps — is imperative. In fact, the earlier phases of the Kill Chain hold the answers to some of the most important questions – both for incidents that have yet to fully unfold and for those that have already occurred.