HB-07Level 4 · Breach scenarioDBIR: Privilege Misuse · VERIS: Misuse
Insider & privilege misuse
- Level 4 · Breach scenario
- 20 signals
- 4 risk domains
A breach in which a person uses entrusted access for a purpose it was never granted for: taking data on the way out, snooping, or abusing dormant privilege.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR: Privilege Misuse · VERIS: Misuse
- NIST CSF 2.0
-
- PR.AA-05
- GV.RR-04
- MITRE ATT&CK
-
- T1078
- T1530
- T1052.001
- T1098.003
-
2
Sequences
End in this breach scenario.
-
6
Cohorts
Predict it.
-
20
Signals
Feed it.
-
4
Risk domains
Where those signals come from.
Sequences that lead here
2 sequences end here.
Each one is a set of signals in order inside a window. Choose one to watch it play.
SQ-DL-013 stepsPeak: Stage 4 Suspected
Quiet exit
Step 01ATT&CK tactic: Reconnaissance
Notice or role change
DH-A-02In a notice period or role change
Stage 1Exposed
Step 02ATT&CK tactic: Collection
Bulk download above baseline
DH-B-01Downloads data in bulk above own baseline
Stage 3Exploited
Step 03ATT&CK tactic: Exfiltration
Personal cloud or USB
DH-B-08Stores work data in personal cloud
Stage 4Suspected
Quiet exit, 3 steps inside 30 days: Notice or role change (DH-A-02 In a notice period or role change, Reconnaissance, Stage 1 Exposed); then Bulk download above baseline (DH-B-01 Downloads data in bulk above own baseline, Collection, Stage 3 Exploited); then Personal cloud or USB (DH-B-08 Stores work data in personal cloud, Exfiltration, Stage 4 Suspected). It leads to HB-07 Insider & privilege misuse.
-
SQ-DL-01
Quiet exit
- Step 1: Notice or role change (DH-A-02 In a notice period or role change)
- Step 2: Bulk download above baseline (DH-B-01 Downloads data in bulk above own baseline)
- Step 3: Personal cloud or USB (DH-B-08 Stores work data in personal cloud)
- Breach scenario: HB-07 Insider & privilege misuse
-
SQ-PRV-01
Dormant to dangerous
- Step 1: Unused privilege (IA-A-03 Privileges unused for 90+ days)
- Step 2: Unusual login (IA-B-04 Signs in from unusual contexts)
- Step 3: New cloud role (IA-A-02 Member of privileged security groups)
- Step 4: Bulk access (DH-B-01 Downloads data in bulk above own baseline)
- Breach scenario: HB-07 Insider & privilege misuse
The definition, in detail
Definition
It is the Privilege Misuse pattern in the Verizon DBIR and the Misuse action in VERIS, the use of entrusted organizational resources or privileges contrary to their intended purpose.
Example
A departing sales director exports the customer list to a personal drive during the notice period.
How it is measured
- Anchor
- DBIR: Privilege Misuse · VERIS: Misuse
- SOC signals
- Insider cases, data exfiltration
- Fed by
- 20 signals across 4 risk domains
How it is used
Programs measure toward Insider & privilege misuse by counting the 20 signals, 6 cohorts and 2 sequences that point to it, and tie them to the incidents the SOC records as insider cases, data exfiltration.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Insider & privilege misuse" (HB-07), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-07-insider-and-privilege-misuse
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.