The hardest adversary to stop already has a badge, a login, and your trust. Insider risk is a people-and-culture problem before it is a technical one — and the controls are set at the top.
Day 2People & CultureInsider risk
Notes: Frame from the start: this is a leadership topic. Culture and access decisions are yours to set.
Lesson 06 · Slide 2
Why insiders are uniquely hard
They have legitimate, trusted access — no perimeter to breach
Their actions look normal — inside the bounds of their job
They know your controls, your blind spots, and your people
Detection means separating misuse from ordinary work — a subtle line
The reframe
Perimeter security assumes the threat is outside. Insider risk assumes it is already inside, holding a valid key.
Notes: Reveal one at a time. The point: the tools that stop outsiders barely touch a trusted insider.
Lesson 06 · Slide 3
Four kinds of insider
Malicious / disgruntled — chooses to harm: theft, sabotage, leaking
Negligent / unwitting — no intent, but clicks, misconfigures, mishandles
Coerced / compromised — recruited, pressured, blackmailed, or bribed by an outsider
Third-party — a trusted supplier, contractor, or partner with inside access
Notes: Most programmes over-focus on the malicious insider. The negligent one is most common; the coerced one is most dangerous. Set up the poll.
Lesson 06 · Slide 4
After normal controls, which insider profile carries the greatest residual risk?
C. The visible malcontent (A) and the careless clicker (B) are the ones your controls and awareness training are built to catch. The coerced or recruited insider is motivated to look normal, has legitimate access, and is being directed by a capable outsider — precisely the profile that defeats routine monitoring. Residual risk is highest where intent is hidden and access is genuine.
Notes: Many pick A. The teaching point: visible risk is managed risk; the dangerous insider is the one you cannot see and who is trying to stay invisible.
Lesson 06 · Slide 5
Indicators — without witch-hunts
Behavioural — sudden grievance, unexplained affluence, boundary-testing, secrecy about work
Proportionate & lawful — indicators trigger review, not accusation
Never demographic — profiling by who someone is is both wrong and useless
Guard-rail
Indicators are signals to look, not verdicts. A programme that punishes the innocent destroys the trust it depends on.
Notes: Be explicit: this is about behaviour and access anomalies, proportionately reviewed — not surveillance of identity. The culture point returns later.
Lesson 06 · Slide 6
Layered controls shrink the blast radius
No single control stops an insider. Layers limit what any one person can do. Press →.
Broad standing access
→
Least privilege & need-to-know
→
Separation of duties
→
Dual control on the crown jewels
→
Sensitive action — now contained & visible
Notes: Reveal step by step. Each layer removes reach. The final node is "contained" — an insider can still act, but not alone and not invisibly.
Lesson 06 · Slide 7
Least privilege & need-to-know
People accumulate access over years and rarely lose it. The default should be the minimum required for the current role, granted for a reason and reviewed.
Why you care
Every unused entitlement is a gift to a compromised insider. Access sprawl is the quiet enabler of the worst incidents.
Notes: Ask the room: when did you last lose an access you no longer need? The silence is the lesson.
Lesson 06 · Slide 8
Separation of duties & dual control
Separation of duties
No single person can both initiate and approve a sensitive action. The classic defence against fraud and sabotage.
Dual control
The most sensitive actions require two people together — so coercion of one is not enough.
Notes: These directly counter the coerced-insider (the poll answer). Two-person integrity means one recruited insider cannot act alone.
Lesson 06 · Slide 9
Access over the whole lifecycle
Joiners — grant the minimum, deliberately
Movers — remove old access when roles change, not just add new
Leavers — revoke fast and completely, including shared and third-party accounts
Continuous evaluation — trust is not a one-time clearance; it is reviewed over time
The mover problem
Long-tenured staff quietly accumulate the keys to everything. The lateral mover, not the leaver, is the usual blind spot.
Notes: Continuous evaluation replaces "vetted once, trusted forever." Movers are the most overlooked lifecycle stage.
Lesson 06 · Slide 10
The trusted-insider paradox
The access that makes someone useful is the same access that makes them dangerous. You cannot eliminate insider risk without destroying the trust your organisation runs on.
The resolution
You do not remove trust — you bound it: least privilege, two-person integrity on the crown jewels, and a culture where concerns surface early.
Notes: This is the intellectual heart of the lesson. The answer is not zero-trust-of-people; it is bounded, verified trust.
Lesson 06 · Slide 11
Culture is the strongest control
People who feel respected and heard are less likely to become malicious
People who trust the process report concerns early — about others and themselves
Blame-free reporting surfaces the coerced insider before the outsider succeeds
Protect legitimate whistleblowing while you detect sabotage — they are not opposites
Leadership move
You decide whether raising a concern feels safe. A punitive culture drives insider risk underground; a fair one is your best sensor.
Notes: Tie back to Lesson 04's golden-hour / reporting culture. The leader's tone determines whether the programme has eyes and ears.
Lesson 06 · Slide 12
One-minute drill: who holds the keys?
Pick your single most sensitive process. In your head or on paper: who can execute it alone? If the answer is "one person," that is your dual-control gap.
Notes: Start the timer. Most leaders find at least one single-person path to something catastrophic. That discovery is the takeaway.
Lesson 06 · Slide 13
Recap & what's next
Insiders are hard because access is legitimate and behaviour looks normal
Bound trust with least privilege, separation of duties, and dual control
A fair, blame-free culture is your best detector — and it is yours to set
Next
Lesson 07 — Endpoint, Laptop & Travel: hardening the devices your trusted people carry into hostile places.
Notes: Bridge: people security and device security meet on the endpoints your staff carry — especially when travelling.