How to Build an Insider Threat Detection System

The Reality of Insider Threats

According to a Ponemon Institute study, 34% of corporate data breaches are caused by insiders. Average time to detection is 77 days, and average damage is $15.6 million per incident.

Types of Insider Threats

• Malicious insider: Intentionally steals data or sabotages systems
• Negligent insider: Accidentally leaks data or violates security policy
• Compromised account: An external attacker hijacks an insider account and uses it

UEBA Detection Scenarios

Baseline Behavior Profile

class BehaviorBaseline:
    def calculate_risk_score(self, event):
        score = 0

        # 비업무 시간 접속
        if not (9 <= event.hour <= 18):
            score += 20

        # 비정상 다운로드량
        if event.download_mb > self.avg_daily_downloads * 5:
            score += 40

        # 미접속 시스템
        if event.system not in self.common_systems:
            score += 15

        return score  # 70 이상 시 경보

DLP Detection Patterns

탐지 대상:
- 이메일 첨부파일 (개인정보, 기밀 문서)
- 웹 업로드 (Google Drive, Dropbox)
- USB 복사 / 프린터 출력

개인정보 패턴:
- 주민등록번호: \d{6}-[1-4]\d{6}
- 신용카드: \d{4}[-\s]\d{4}[-\s]\d{4}[-\s]\d{4}

Post-Detection Response Process

이상 탐지 경보
     ↓
HR + 법무 + 보안팀 공동 검토 (24시간 이내)
     ↓
실제 위협 → 즉시 계정 잠금 + 증거 보존
          → 디지털 포렌식 조사
          → 징계/법적 조치

Legal and Ethical Considerations

• Personal Information Protection Act: Employees must be notified that monitoring is in place
• Employment rules: Explicitly include IT-resource monitoring clauses
• Data minimization: Collect only work-related activity

Set policy with legal counsel so personal privacy is not invaded, and notify employees transparently—that approach is more effective in the long run.

Privilege Management Is Prevention

The defense that comes before detection is making access impossible in the first place.

• Least privilege (PoLP): Grant only the minimum privileges required for the job.
• JIT (Just-In-Time) access: Eliminate standing admin privileges; grant temporary, approval-based access when needed.
• Periodic access recertification (Access Review): Quarterly, owners re-approve whether the person still needs that privilege.

Offboarding Checklist for Departing Employees

A large share of insider incidents cluster around resignation.

□ 퇴직 통보 시점부터 민감 시스템 접근 모니터링 강화
□ 마지막 근무일 계정 즉시 비활성화(삭제 전 보존)
□ VPN·SaaS·코드 저장소·클라우드 키 일괄 회수
□ 공용 계정 비밀번호 변경
□ 반출 기기·USB 회수 및 데이터 삭제 확인

Example SIEM/UEBA Correlation Rule

규칙: 퇴직 예정자 + 대량 다운로드
조건:
  user IN (HR.퇴직예정자_목록)
  AND download_volume > baseline * 3
  AND (destination = 외부저장소 OR USB)
액션: 즉시 보안팀·HR 공동 경보, 세션 기록

Korean Legal Basis

Technology leakage (especially national core technologies such as semiconductors and batteries) is subject to the Industrial Technology Protection Act and the Unfair Competition Prevention Act. Trade-secret leakage is a criminal offense, and legal protection requires that you can prove secrecy management (access control, marking, and NDAs) in advance.

Frequently Asked Questions (FAQ)

Q. Isn’t employee monitoring illegal? Monitoring of work IT resources is permitted if there is prior notice and an explicit clause in the employment rules. Looking into private life (personal messengers, etc.) can be illegal, so limit the scope to work and consult legal.

Q. Can we start without UEBA? Yes. First embed basic controls such as least privilege, log collection, and leaver offboarding, then introduce UEBA when automated anomaly detection is needed. A staged approach is more cost-effective.