“The vast majority of security threats follow a pattern or sequence of activity leading up to an attack, and insider threats are no exception,” said Dr. Larry Ponemon, Chairman and Founder, Ponemon Institute. “Many security professionals are already familiar with Lockheed Martin’s Cyber Kill Chain and the MITRE ATT&CK Framework, both of which describe the various stages of an attack and the tactics utilized by an external adversary. Since human behavior is more nuanced than machine behavior however, insider attacks follow a slightly different path and, therefore, require modern approaches to combat.”

Over the course of thousands of insider threat investigations and incidents, DTEX’s Counter-Insider Threat Research analysts have identified the insider equivalent of these frameworks: the Insider Threat Kill Chain, which encompasses the five steps present in nearly all insider attacks: Reconnaissance, Circumvention, Aggregation, Obfuscation and Exfiltration.

To fully understand an insider incident, the researchers say visibility into the entire kill chain — not just one or two steps — is imperative. In fact, the earlier phases of the Kill Chain hold the answers to some of the most important questions – both for incidents that have yet to fully unfold and for those that have already occurred.

The findings of this report reveal that enterprises are missing the warning signs of insider threats and the intent of perpetrators. Key findings include:

•    Nearly half of companies find it impossible or very difficult to prevent an insider attack at the earliest stages of the Insider Threat Kill Chain.

•    Only 32% of companies say their organizations are very or highly effective in preventing the leakage of sensitive information.

•    15% of organizations state that no one has ultimate authority and responsibility for controlling and mitigating workforce risks.

To view the full The State of Insider Threats 2021: Behavioral Awareness & Visibility Remains Elusive Report, click here.