A malicious insider is a rogue employee or contractor who uses their position to sell or leak company secrets, expose intellectual property, or cause other harm. Unlike an outside attacker, this person may already have legitimate access, making the risk especially difficult to prevent. section 1.1
Limit sensitive data to people who need it for their work. Need-to-know access reduces the amount of information a bad actor can reach if an employee or contractor turns against the organization. section 1.1
Insider leak scenario
A contractor with access to confidential company information decides to leak or sell it. Restricting that contractor to only the data required for the assignment narrows the potential exposure. section 1.1
