# Topic 6: Insider Threats An **insider threat** is a cyber security risk that originates from within the targeted organization. It involves current or former employees, contractors, or business partners who have authorized access to the organization's network, systems, or data, and use that access—either deliberately or accidentally—to compromise security. --- ## Categories of Insider Threats For VCE Software Development, you must distinguish between the two primary classes of insider threats: | Category | Description | Examples | | :--- | :--- | :--- | | **Malicious Insider** | An insider who intentionally abuses their access credentials to steal data, commit sabotage, or sell proprietary information. | * A disgruntled employee deleting files before quitting.<br>* Selling source code to a competitor. | | **Negligent / Accidental Insider** | A well-meaning employee who unintentionally compromises security through ignorance, carelessness, or human error. | * Accidentally committing API keys to a public GitHub repository.<br>* Clicking a link in a phishing email.<br>* Losing a work laptop containing customer data. | --- ## ⚠️ Risks to Development Environments In software development, insider threats present unique challenges: 1. **Code Sabotage**: A developer can insert a "logic bomb" (code that executes a malicious payload under specific conditions, like on a certain date) or a hidden backdoor directly into the codebase. 2. **Intellectual Property (IP) Theft**: Software source code is highly valuable. An insider can copy repositories to a USB drive or cloud storage to take to a competitor or use for their own startup. 3. **Data Deletion**: System administrators or database developers often hold access keys that could wipe out production databases or backups in minutes. --- ## Real-World Case Study: Tesla IP Theft (2018) > [!CAUTION] > **What Happened**: In June 2018, Tesla filed a lawsuit against a former process technician/software engineer. > > **The Incident**: The employee was upset about not receiving a promotion. In retaliation, they wrote a script that modified the code of Tesla's manufacturing operating system. This code change was designed to sabotage production operations. > > **Data Exfiltration**: The employee also exported gigabytes of highly confidential proprietary data—including photos and videos of Tesla's manufacturing systems—to external servers. Because they had legitimate developer access, they bypassed standard network security firewalls. --- ## Mitigation Strategies & Controls Mitigating insider threats requires a balance between trust and strict verification: ### Software Controls (Technical) * **Version Control Auditing**: Use git platforms to track every line of code written, ensuring every commit is linked to a verified user account. * **Multi-Developer Approvals (Branch Protection)**: Configure repositories so code cannot be merged directly into the `main` branch without peer review and approval from at least one other developer. This prevents a single malicious user from pushing backdoors. * **Data Loss Prevention (DLP)**: Use software that monitors and blocks unauthorized transfers of large files or source code to USB drives, personal email accounts, or cloud storage. * **Detailed Log Auditing**: Maintain immutable logs of system access, database queries, and code checkouts to ensure all user actions can be audited. ### Administrative Controls (Organizational) * **Background Checks**: Conduct thorough criminal and background screening when hiring developers. * **Non-Disclosure Agreements (NDAs)**: Have all staff sign legally binding NDAs during onboarding to protect intellectual property. * **Separation of Duties**: Ensure no single employee has control over all aspects of a critical system (e.g., the developer who writes the code should not be the only one who can authorize its deployment to production). --- ## VCE Exam Practice ### Scenario *AppGen* develops mobile games. A senior developer, angry about being made redundant, decides to sabotage their upcoming game release. On their final day, before their accounts are deactivated, they insert a line of code that crashes the app if a user attempts an in-app purchase. The code goes unnoticed and is shipped to the app store, resulting in thousands of bad reviews and loss of revenue. ### Questions 1. **Identify** whether the senior developer is a malicious or negligent insider threat, providing a reason. *(2 marks)* 2. **Explain** the business consequences of this cybersecurity incident on AppGen. *(2 marks)* 3. **Propose and justify** one software control that AppGen could have implemented to prevent this malicious code from reaching the public app store. *(3 marks)* --- > [!NOTE] > **Suggested Answers:** > 1. *The developer is a malicious insider threat. This is because they intentionally used their authorized development access to insert destructive code designed to sabotage the company's product in retaliation for being made redundant.* > 2. *The business consequences include financial loss (lost revenue from failed in-app purchases) and severe reputational damage (negative customer reviews on the app store, which could deter future downloads).* > 3. *Implement Branch Protection and Mandatory Code Reviews. By configuring the repository so that no developer can merge code directly into the production branch without a peer review, another developer would have inspected the code, detected the malicious logic, and blocked the release.*