Performing Insider Threat Investigation

When to Use

• DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices
• User behavior analytics (UBA) detects anomalous access patterns for a user account
• HR reports a departing employee suspected of taking proprietary information
• A privileged user is observed accessing systems outside their job function
• Whistleblower or coworker report alleges policy violations or data theft

Do not use for external attacker investigations where compromised credentials are used without insider collusion; use standard incident response procedures instead.

Prerequisites

• Legal counsel approval before initiating any monitoring or investigation of an employee
• HR partnership with defined investigation procedures and employee privacy guidelines
• DLP platform with content inspection and policy enforcement (Symantec DLP, Microsoft Purview, Digital Guardian)
• User behavior analytics platform (Microsoft Sentinel UEBA, Exabeam, Securonix)
• Forensic imaging capability for endpoint examination
• Chain of custody procedures for evidence that may be used in legal proceedings
• Clear authority and scope documentation approved by legal and HR

Workflow

Step 1: Receive and Validate the Allegation

Document the initial report and validate before proceeding:

• Record the source of the allegation (DLP alert, UBA detection, HR referral, manager report)
• Confirm with legal counsel that the investigation is authorized
• Define the investigation scope: what activity is being investigated, time period, systems involved
• Establish the investigation team: security, legal, HR (never investigate alone)
• Create a restricted case file accessible only to the investigation team

Investigation Authorization:
━━━━━━━━━━━━━━━━━━━━━━━━━━━
Case ID:           INV-2025-042
Subject:           [Employee Name] - [Title] - [Department]
Allegation:        Unauthorized transfer of proprietary data to personal cloud storage
Reported By:       DLP system alert + manager concern
Legal Approval:    [Counsel Name] - 2025-11-15
HR Liaison:        [HR Name]
Scope:             File access and transfer activity from 2025-10-01 to present
Systems in Scope:  Workstation, email, cloud storage, VPN, DLP logs

Step 2: Collect Evidence Covertly

Gather evidence without alerting the subject to the investigation:

Log-Based Evidence (non-intrusive):

• DLP logs: file transfers, policy violations, content matches
• Cloud access logs: SharePoint, OneDrive, Google Drive activity
• Email logs: messages to personal accounts, large attachments, forwarding rules
• VPN and authentication logs: access times, locations, devices
• Badge access logs: physical access patterns
• Print logs: large print jobs of sensitive documents
• USB device connection logs: device type, serial number, connection times

User Activity Monitoring (requires legal approval):

• Screen capture or session recording (only if legally authorized and documented)
• Keystroke logging (jurisdiction-dependent, requires explicit legal approval)
• Network traffic capture for the subject's workstation

Endpoint Forensics (if warranted by evidence):

• Create forensic image of the subject's workstation
• Analyze browser history, download history, and installed applications
• Examine deleted files and Recycle Bin contents
• Review cloud sync application logs (Dropbox, Google Drive desktop client)

Step 3: Analyze User Behavior Patterns

Build a behavioral profile comparing normal vs. anomalous activity:

Behavioral Analysis:
━━━━━━━━━━━━━━━━━━
Normal Baseline (6-month average):
- Login time: 08:30-09:00 weekdays
- Files accessed: 15-25 per day (marketing department files)
- Email volume: 45 sent, 80 received per day
- Data transferred: 50MB per day average
- USB usage: None

Investigation Period (last 30 days):
- Login time: 22:00-02:00 (after hours, multiple occasions)
- Files accessed: 200+ per day (finance, engineering, executive files)
- Email volume: 120 sent per day (30% to personal gmail)
- Data transferred: 2.5GB per day average
- USB usage: 3 unique devices connected (Kingston DataTraveler)
- Print jobs: 847 pages (competitor analysis, customer lists, source code)

Anomaly Score: 94/100 (Critical)

Step 4: Reconstruct the Activity Timeline

Build a chronological timeline of the subject's actions:

Timeline of Activity:

…