Insider Risk Basics

Insider risk is the one alert class where the desk's instinct to investigate is wrong: these
cases carry employment-law, privacy-law and evidence-integrity consequences a service desk
cannot manage. Recognize it, freeze the evidence, hand it to whoever has authority to act.

1. Recognize the category. External attacker → normal IR runbooks; accident or policy
   ignorance → normal support and training. Signs of INTENTIONAL insider activity — bulk
   copies to personal storage around a resignation, access outside role scope with evasion
   behavior, sabotage indicators, credential sharing for concealment — mean this skill, and
   solo investigation STOPS here.
2. Preserve evidence quietly and passively. Record what has already been observed — alert
   contents, timestamps, systems involved — in a restricted plain-text note. Direct the tech
   to preserve, not pull: stop relevant logs aging out of retention, hold existing exports
   as-is, note (don't act on) the accounts and devices involved. Recommend a litigation hold
   where mail or file preservation is needed. Do NOT image machines, pull the user's mailbox,
   review their files or widen log searches beyond what already fired — scope expansion
   belongs to whoever the client authorizes, under legal guidance.
3. Do not tip off. No confrontation, no questions to the suspected employee, no account change
   they would notice — no sudden access revocation, password reset or detectable monitoring —
   unless the client's leadership directs it after escalation.
4. Keep it confidential. Discuss with the minimum set: the desk's management and the client's
   designated authority. Keep the ticket restricted — internal-only notes, a generic title, not
   "Investigating <user>". The suspect's manager is NOT automatically in the loop;
   managers can be involved parties; the client's leadership or HR decides who knows.
5. Escalate per policy, fast. Check the client's documented policy for insider and HR-security
   matters and route to the named authority — otherwise to their senior leadership via the
   desk's management, on a call or restricted channel, not a visible thread. Present
   observations only: what was seen, when, what has been preserved. The client decides
   what happens next.
6. Then follow direction. After escalation the desk acts only on documented instructions from
   the client's authorized decision-maker ("revoke access at 5 p.m. Friday"), each instruction
   and its execution timestamped — nothing on verbal hallway authority. If it turns out to be
   external compromise, hand back to the standard runbooks.

Observations, not accusations: notes record events and evidence state, never intent
conclusions. With no documented client policy, escalate through the desk's management to the
client's most senior appropriate contact; absence of a policy never means the desk
investigates instead.