The Inside Job: Assessing the Risks of Insider Threats to Industrial Environments

The focus of industrial cybersecurity has predominantly been about defending against external cyber criminals and Advanced Persistent Threats (APTs). While those efforts are indeed valid, a growing body of evidence indicates that insiders - witting/unwitting employees and third-party contractors - also pose a significant threat to OT environments. Due to their privileged access and technical know-how, attacks launched by malicious/non-malicious insiders have the potential to cause the same level of damage, disruption, safety hazards, and financial loss in comparison to external threat actors. Threat actors often have to obtain network access, escalate privileges once in the network, then create lines of code that targets specific vendor devices, versions, etc. which, although achievable, can make launching a sophisticated attack time consuming with a high chance of failure. In this presentation, we will discuss the growing threats insiders pose to industrial environments, how dark web threat actors are leveraging insiders to carry out attacks, and recommendations on how you can counter insider threats within your organization.