Name two common indicators of an insider threat.

• A. Unusual or repeated access to restricted areas; attempts to bypass security controls or share sensitive information.
• B. Consistently reporting all security anomalies.
• C. Following all security procedures exactly.
• D. Maintaining perfect records of asset handling.

Answer: (A)

Insider threats come from people who have legitimate access but may misuse it. Two common indicators are unusual or repeated access to restricted areas and attempts to bypass security controls or share sensitive information.

Unusual access patterns show someone moving into zones outside their normal job duties, especially at odd hours or more often than usual. This can signal curiosity, intent, or preparation to misuse access.

Attempts to bypass security controls or to share sensitive information point to deliberate effort to defeat protections or exfiltrate data, which is a hallmark of misuse by someone with authorized access.

The other options represent good security behavior rather than warning signs: consistently reporting security anomalies suggests proactive risk awareness; following procedures exactly and maintaining perfect asset records indicate compliance and diligence, not insider risk.