Which type of attack involves employees using their credentials to copy proprietary software onto an...

An insider threat involves a trusted user, such as an employee, contractor, or partner, misusing authorized access to harm the organization or expose sensitive assets. In this scenario, employees use valid credentials to copy proprietary software onto an external drive. The issue is not that an attacker stole their identity or tricked them through phishing; the users already have access and are misusing it. Social engineering manipulates people into taking unsafe actions. Spear phishing is a targeted form of social engineering, typically involving crafted messages to steal credentials or deliver malware. Identity theft involves unauthorized use of someone else’s identity. Insider threats are difficult because activity may appear legitimate at first: the user logs in normally and accesses systems they may be permitted to use. Controls such as least privilege, DLP, behavior analytics, logging, removable media restrictions, and strong offboarding processes help reduce insider risk. Reference/topics: Cybersecurity 1.3, insider threat; Network Security 3.5, DLP; Identity Security 7.2.3, least privilege.