Insider Risk by Design
Designing so that a legitimate operator cannot silently exceed their remit, treating the trusted internal user as part of the threat model.
Threat models that stop at the perimeter miss the actor with valid credentials, appropriate access and an ordinary-looking session. That actor may be malicious, coerced, or simply an attacker using stolen credentials — from the system's point of view these are indistinguishable, which is why the control set is the same.
The design responses do not rely on trust judgements. Least privilege with no standing access, so ordinary operation requires no ability to read production data. Segregation of duties for consequential actions, so a single person cannot both initiate and approve. Immutable audit logging written to a store the operator cannot modify, which is the control most often compromised by having administrators own the logging platform too. Access to data recorded at the record level for sensitive datasets, so bulk reads are visible.
The detection that actually works is behavioural rather than rule-based: volume anomalies — an account that normally reads twenty records reading twenty thousand — access outside normal hours or from unusual locations, and queries touching data unrelated to the person's caseload.
The organisational precondition that makes this palatable: frame it as protection for the individual as much as from them. An engineer with no standing access cannot be blamed for an incident they could not have caused, and cannot be the target worth phishing.