How should suspected insider threats be handled?

• A. Ignore until symptoms appear.
• B. Follow policy: report to security, contain where feasible, preserve evidence, and initiate investigation.
• C. Immediately terminate without investigation.
• D. Publicly disclose to all users.

Answer: (B)

Handling suspected insider threats relies on a policy-driven, coordinated incident response. The best approach is to follow policy by reporting the concern to security, containing the suspected activity where feasible, preserving evidence to maintain a usable trail, and initiating a formal investigation. This sequence ensures consistent action, legal and regulatory compliance, and minimizes harm while data helps reveal what happened. Reporting to security brings in trained responders who can assess risk, perform forensics, and coordinate with HR or legal as needed. Containment reduces ongoing damage without prematurely destroying evidence. Preserving evidence maintains the chain of custody for investigations and potential disciplinary or legal actions. Investigating promptly helps determine whether there was malicious intent, the scope of access, affected systems, and what controls failed or were bypassed, which informs remediation and prevention.

Ignoring the issue until symptoms appear allows damage to accumulate and reduces chances to stop it in time. Terminating someone immediately without investigation risks unfair treatment and could erase important data or evidence. Publicly disclosing to all users is inappropriate and could violate privacy, undermine investigations, and cause unnecessary panic.