This blog will bring you through the Australian Information Security Manual (ISM), with a focus on controls ISM1625 and ISM1626 – two key measures for managing insider threats. It aims to highlight the relevance of these controls within the broader security framework and offer guidance on how to effectively implement mitigation strategies and address such threats. It also stresses the importance of obtaining sound legal advice to ensure compliance and protect organisational interests. This content is intended for anyone undertaking an Information Security Registered Assessors Program (IRAP) assessment, providing practical advice for navigating these key aspects of the ISM.
As organisations build controls to manage the ever-changing external threat landscape, they are now challenged with new threats from within. In the last few years, insider risk concerns have grown significantly, now accounting for a large proportion of internal data leaks.
An insider threat is when an insider either intentionally or unintentionally uses their access to conduct activities that could cause harm to, or negatively affect the organisation. To counter the threat, a strong and positive security and integrity culture is required.
An approach to building a robust trusted insider risk program requires a whole business approach, it’s not simply an IT department problem. An insider risk program should focus on four main pillars, these pillars align with the Attorney Generals department’s advice and are outlined below.
The Four Pillars of Insider Risk Management
Onboarding Security Checks
Employee screening and background checks
Training
Conduct employee training and security awareness sessions
Monitoring
Conduct regular risk assessments and invest in threat detection tools
Reporting Mechanisms
Enable reporting systems and enforce a culture of security and trust
The Four Pillars of Insider Risk Management
Onboarding Security Checks
Employee screening and background checks
Training
Conduct employee training and security awareness sessions
Monitoring
Conduct regular risk assessments and invest in threat detection tools
Reporting Mechanisms
Enable reporting systems and enforce a culture of security and trust
Pillar One: Onboarding Security Checks
Trusted insiders can circumvent existing controls to ensure their approaches are successful. Early detection and response are vital to prevent larger-scale losses and mitigate further harms. In this context, consideration should also be given to the risk posed by potential new personnel. This can be identified and addressed during recruitment and onboarding processes.
Employee screening good practices and checks:
- Many historical cases of espionage and insider attacks involve individuals facing financial difficulties or seeking a lucrative payout. Financial strain can drive employees to compromise security for personal gain. For example, Yahoo’s 2022 lawsuit, which alleged that their former employee stole large amounts of Intellectual Property (IP) upon securing a competitor job offer. Conducting credit checks as part of employee screening helps identify financial distress, such as debt accumulation, which can be an early indicator. This proactive measure supports broader risk management strategies to protect against espionage and data breaches.
- Outsourcing a background check agency could help the business in collecting financial information on candidates while respecting their privacy for any public knowledge of substantial financial debt.
- Through the interview process these red flags should be sought out and a health candidate profile should be considered in making the best decision and hire for the business.
- Past performances or track records of any insider cases, companies etc. should not be held against the individual or candidate but rather questions should be asked around the manor or instance so the hiring business can make the best possible educated and fair decision based on the interview and onboarding process.
- Geopolitical space: it would also be wise to consider the geopolitical space and any national corporate espionage with a strong standing track record, ex China stealing military PI through cybercrime and espionage.
Pillar Two: Training
The initial education for new personnel should be integrated into the onboarding process. This training must be complemented by annual security awareness sessions and continuous communication regarding security, privacy, fraud, and corruption. Organisations should ensure that all insiders, whether permanent or temporary, receive the same level of training and awareness. This ensures personnel understand what constitutes a reportable incident and the process for reporting it. Clear policies should define insider risks and outline the specific steps for making a report.
The training of employees becomes compounded in its effectiveness when:
- Employees are trained to recognise red flags, suspicious behaviour, and potential threats such as phishing emails.
- Employees take appropriate security habits so they do not fall prey to attackers that could exploit their authenticated access to compromise the organisation. Building a healthy and positive ‘secure’ working culture will breed better overall secure practices across the individual and combined with the other pillars, can lead to less incidents.
Thus, appropriate training of employees, especially high level or sensitive access individuals, is a very effective and important pillar in thwarting malicious attempts.
Pillar Three: Monitoring
Implementing strategies, processes, and tools to detect, prevent, and respond to potential security threats posed by individuals within an organisation is key. Insider risks can arise from malicious actions, such as intentional data theft or sabotage, as well as from unintentional behaviour, such as inadvertent data exposure or policy violations.
An insider threat approach needs to remain flexible and adaptable therefore monitoring of the program’s implementation is also critical to its success.
When deciding the correct approach, organisations should start by:
- Establishing clear monitoring objectives: This can help provide direction to what is most important and keep excessive noise from bogging things down. Many times, organisations fall into the trap of wanting to capture or monitor ALL things. This is just simply not achievable for most average sized organisations and their cybersecurity/ risk budget. It can also become a resource restraint on an already lean cybersecurity staff.
- Conducting regular risk assessments: This will help the organisation continue to fine tune its monitoring, tracking, and logging, ensuring that as risk to the organisation changes, the monitoring plan and procedures change accordingly to remain inline.
Investing in Threat Detection and response tools:
- Data Loss Prevention (DLP): Deploy DLP tools to monitor and restrict sensitive data from being emailed or transferred to external devices without authorization.
- Security Information and Event Management (SIEM): Use SIEM platforms to correlate various data points, enabling faster detection of unusual patterns that might indicate insider threats.
- Incident response automation: Implement automated response mechanisms to quickly contain potential threats, such as disabling accounts or quarantining compromised systems.
Common threat detection tools can help reduce the burden on the business, resources and help automate the collection and aggregation of monitoring data, logs etc. As great as tools are, they should always be accompanied with a well-trained staff and align to the purpose set out by the organisation, which should be driven by the results of the risk assessments.
Pillar Four: Reporting Mechanisms
Reporting enables employees, contractors, and other personnel to report suspicious behaviours, policy violations, and other activities that could pose risks to the organisation. Effective reporting systems encourage transparency, facilitate early threat detection, and reinforce a culture of security and trust.
Employees are more likely to report suspicious activity if they feel safe from retaliation. Clear policies against retaliation and strong protections for whistleblowers demonstrate organisational commitment to protecting employees who act in good faith. Channels should be available to all employees, including remote or contract workers, to ensure inclusivity across the organisation.
Additionally, organisations should seek legal advice during the development and implementation of a trusted insider risk program due to the nature of some controls having a level of surveillance and a wide range of legislation needs to be considered.
A good rule of thumb is to make all reporting as digestible and easily understood for audiences, not just in the cyber or IT space, but also in other levels of the organisation, as cybersecurity is a holistic team effort and only as strong as the weakest link.
Keeping the reporting clear and concise when moving outside of technical persons will help other departments understand their responsibility and the consequences of breaches, spills or intrusions.
Cybersecurity is a holistic team effort and only as strong as the weakest link.
If organisations implement the above and begin to develop and maintain their insider threat mitigation program, you will most likely be meeting the control requirements for ISM1625 and ISM1626. Given the nature of the IRAP assessments, it will also be very important to document and maintain with the organisation’s relevant document change management program.
Support for ISM and IRAP Compliance
To meet your ISM or IRAP needs organisations need to ensure their controls are robust and well-aligned with ISM requirements. Sekuro has an expert GRC team ready to guide you through the entire IRAP process. Through ISM/IRAP gap assessments, we can help identify areas of improvement, create a tailored roadmap for addressing those gaps, and drive the necessary uplift efforts. Working alongside your security staff, we provide expert consultation, guidance, and hands-on support in developing or refining policies, protocols, and guidelines to strengthen your organisation’s security posture against insider threats.
Nicolas Baragar
Senior Consultant, GRC and IRAP, Sekuro
Nick is a Senior Consultant on Sekuro’s GRC and IRAP team, dedicated to providing ongoing support and driving effective program outcomes for clients. With over 15 years of experience in the IT and cybersecurity industry, Nick brings a broad depth of real-world knowledge gained through consulting across both the United States and Australia. His core philosophy centres on maintaining an equal balance between people, process, and technology to deliver practical, actionable, and simplified security solutions.
Chris Ekert
GRC Managing Consultant, IRAP, Sekuro
Chris Ekert is a Managing Consultant and IRAP Assessor who leads the IRAP team across Australia, With a multidisciplinary team who specialise with Global Tech Giants across many frameworks. Chris's exposure and input across the wider Governance Risk and Compliance team gives the ability to partake and drive complex engagements.
