How to Build an Insider Threat Detection System

The Reality of Insider Threats

According to a Ponemon Institute study, 34% of corporate data breaches are caused by insiders. Average time to detection is 77 days, and average damage is $15.6 million per incident.

Types of Insider Threats

• Malicious insider: Intentionally steals data or sabotages systems
• Negligent insider: Accidentally leaks data or violates security policy
• Compromised account: An external attacker hijacks an insider account and uses it

UEBA Detection Scenarios

Baseline Behavior Profile

class BehaviorBaseline:
    def calculate_risk_score(self, event):
        score = 0

 # when
        if not (9 <= event.hour <= 18):
            score += 20

 #
        if event.download_mb > self.avg_daily_downloads * 5:
            score += 40

 # when
        if event.system not in self.common_systems:
            score += 15

 return score # 70 when

DLP Detection Patterns

 :
- file (, )
- (Google Drive, Dropbox)
- USB /

 :
- : \d{6}-[1-4]\d{6}
- : \d{4}[-\s]\d{4}[-\s]\d{4}[-\s]\d{4}

Post-Detection Response Process

     ↓
HR + + (24when )
     ↓
 → when +
 →
 → /

Legal and Ethical Considerations

• Personal Information Protection Act: Employees must be notified that monitoring is in place
• Employment rules: Explicitly include IT-resource monitoring clauses
• Data minimization: Collect only work-related activity

Set policy with legal counsel so personal privacy is not invaded, and notify employees transparently—that approach is more effective in the long run.

Privilege Management Is Prevention

The defense that comes before detection is making access impossible in the first place.

• Least privilege (PoLP): Grant only the minimum privileges required for the job.
• JIT (Just-In-Time) access: Eliminate standing admin privileges; grant temporary, approval-based access when needed.
• Periodic access recertification (Access Review): Quarterly, owners re-approve whether the person still needs that privilege.

Offboarding Checklist for Departing Employees

A large share of insider incidents cluster around resignation.

□ whenfrom when
□ when
□ VPN·SaaS· save·
□
□ ·USB check

Example SIEM/UEBA Correlation Rule

: +
:
 user IN (HR._list)
  AND download_volume > baseline * 3
 AND (destination = externalsave OR USB)
: when ·HR ,

Korean Legal Basis

Technology leakage (especially national core technologies such as semiconductors and batteries) is subject to the Industrial Technology Protection Act and the Unfair Competition Prevention Act. Trade-secret leakage is a criminal offense, and legal protection requires that you can prove secrecy management (access control, marking, and NDAs) in advance.

Reducing False Positives in Detection Rules: Cause, Backtest, Tuning

Insider-threat rules often flood analysts with alerts the moment they're enabled, and once analysts start ignoring alerts, real incidents get missed too.

Causes

• A short baseline period flags periodic work such as month-end closing or quarterly reporting
• Shared accounts, service accounts, and backup jobs are evaluated with the same rules as people
• Normal new access right after a transfer or permission change is flagged

Verification: backtest the rule on past logs Before enabling a rule, apply it to the last 30–90 days of logs and look at alerts per user.

-- e.g. backtest for "large downloads outside business hours"
SELECT user_id, count(*) AS alerts
FROM file_access_log
WHERE action = 'download'
  AND extract(hour FROM ts) NOT BETWEEN 8 AND 19
GROUP BY user_id, date_trunc('day', ts)
HAVING sum(bytes) > 500 * 1024 * 1024
ORDER BY alerts DESC;

If alerts concentrate on a few accounts, check those accounts' job characteristics first.

Tuning

• Split service accounts into their own rules (use outside allowed sources/hours) and record a reason and expiry for each exception.
• Use a peer-group baseline (same department/role) alongside individual baselines to absorb periodic work.
• Feed HR events such as transfers and planned departures into the rules.

Prevention

• Record "true/false positive" at case closure and review each rule's true-positive ratio quarterly. Analysis of logs containing personal data should follow internal policy and employee notice procedures.

Frequently Asked Questions (FAQ)

Q. Isn’t employee monitoring illegal? Monitoring of work IT resources is permitted if there is prior notice and an explicit clause in the employment rules. Looking into private life (personal messengers, etc.) can be illegal, so limit the scope to work and consult legal.

Q. Can we start without UEBA? Yes. First embed basic controls such as least privilege, log collection, and leaver offboarding, then introduce UEBA when automated anomaly detection is needed. A staged approach is more cost-effective.