How should POA address insider threat differently from external threats?

• A. Insiders are external threats.
• B. Outsiders can be blocked only by perimeter controls.
• C. Technology controls alone are sufficient to prevent insider incidents.
• D. Insiders are trusted individuals who may abuse access; address with least privilege, monitoring, separation of duties, and security culture.

Answer: (D)

Insider threats come from people who already have legitimate access, so defenses must focus on how access is granted and how it’s used, not just on keeping others out. The best approach recognizes that insiders are trusted individuals who may abuse their access, and it addresses this with least privilege (giving each person only what they need to do their job), ongoing monitoring of activity, separation of duties (requiring multiple people to complete sensitive tasks), and a security-minded culture that emphasizes accountability and prompt reporting of suspicious behavior. Together, these controls reduce the risk that a trusted user will misuse access, and they create layers that detect and deter abuse from within.

Why the other ideas don’t fit as well: treating insiders as simply external threats ignores that they already have access and can misuse it from inside; relying on perimeter controls alone to block outsiders ignores the reality that external threats can adapt and that many attacks blend in with normal activity and can be harder to stop with walls alone; and believing technology controls alone are enough overlooks the human factor—processes, oversight, and culture are essential to preventing insider incidents.