Lab Guide — Insider Scenarios Tabletop
Facilitated exercise · 40 minutes · Fictional scenarios
What this lab is
A tabletop using short fictional personnel scenarios. For each, your group classifies the insider type and selects the controls that would have prevented or detected it. The aim is to build the instinct to reach for the right control, and to see how culture and access design do most of the work.
Scenario 1
The quiet download
A long-tenured analyst, recently passed over for promotion, begins downloading large volumes of files outside their project late at night.
- Which insider type(s) fit? What is the ambiguity?
- Which controls detect this? Which would have limited the damage?
Scenario 2
The helpful contractor
A third-party contractor asks a staffer to "quickly run" a transaction using the staffer's access, citing a deadline. The staffer obliges.
- Classify the risk. Who are the two insiders here?
- Which control (separation of duties? dual control? need-to-know?) breaks this?
Scenario 3
The pressured colleague
A well-regarded employee with financial troubles is approached externally and offered money for occasional "small favours" involving their normal access.
- Which type is this, and why is it the hardest to detect?
- What technical and cultural measures raise the chance they report the approach instead?
✓ Self-check: for each scenario your group named the insider type(s), identified at least one preventive and one detective control, and can explain why a blame-free reporting culture changes the outcome of Scenario 3.