Healthcare GRC
Trust but Verify: The Overlooked Insider Threat Hiding in Your Application Logs
Organizations today are heavily invested in comprehensive defense-in-depth and zero-trust strategies to keep up with the relentless pace of cybersecurity.
From implementing robust network segmentation to leveraging endpoint detection and response (EDR) technologies. Security logs are feeding into security information and event manager (SIEM), and Security Operations Center (SOC) teams are monitoring and responding to threats in real time.
Despite these efforts, a common theme we see in our line of work is the critical vulnerability of the insider threat.
A recent example highlights this reality; nine employees were terminated at Texas Health and Human Services Commission due to a privacy breach. The impact of the breach resulted in at least 94,000 individuals PHI, and social security numbers were inappropriately accessed, used, or disclosed (1).
Application Insider Threat Case Example
You do everything correctly, right?
A thorough onboarding program exists where HR performs background checks. The background check contains criminal, healthcare exclusion lists, education, and experience verification as a standard part of protocol. Every team member is required to undergo security awareness training and HIPAA training at least annually. The compliance team is proactive in sending training refresher reminders.
The blind spot
The environment is built with access control in mind with permissions based on roles and least privilege. But here’s the problem: the logs from the applications that your personnel utilize daily (such as billing software, laboratory, and more) sit dormant. The logs are thorough; they capture every instance of access, patient lookup, and data export activity. However, application logs are not generally fed into the enterprise SIEM for monitoring. When needed, the SOC team can access the logs and see what activity was conducted. Yet, no one or no system is generally proactively monitoring the logs.
When compliance comes knocking
It starts with a “knock” on the door from compliance. We have an issue. We need an investigation. Please pull logs for employee John Doe.
The SOC team pulls the logs, and what you find turns your stomach. John Doe, a vetted employee who has been with the company for over a decade, has been quietly exporting volumes of patient demographics from an insurance queue. This wasn’t exported in bulk to trigger any alarms from the network monitoring systems because John Doe methodically extracted data in small batches, slowly over time. The logs reveal this activity has been going on for at least three years.
The situation escalates quickly. A full-blown investigation has been launched. Now your company is combing through years of unmonitored activity to determine the scope of the breach, regulatory impact, and potential penalties. The situation becomes scary, and the question remains: What other incidents might be looming in those application logs?
You realize it too late; insider threats are real, and they hide in plain sight. Your company had the data all along, but no one, or no system, was looking.
What should organizations do?
Ingest application logs
Ingesting application logs into your SIEM should be treated with the same priority as infrastructure logs. These logs provide crucial visibility into user actions and application-layer behavior, which are often key indicators in identifying insider threats.
Utilize user behavioral analytics (UBA)
Behavioral baselines should be established and monitored over time using User Behavior Analytics (UBA) to flag anomalous activities. UBA leverages machine learning to understand normal user habits and behavior (such as typical login times, data access patterns) and then detects deviations from the standard.
Automate workflows
Add automation where possible, such as alerting workflows, is essential to quickly notify incident response teams when suspicious behavior is detected. Configuring your SIEM to send real-time alerts to appropriate response teams is essential for timely action.
Leveraging Security Orchestration, Automation, and Response (SOAR) technologies can further streamline workflows by automating repetitive tasks through playbooks and enabling coordinated responses across multiple tools.
Develop custom reporting
Regular reporting combined with random spot checks is essential for uncovering patterns or anomalies that may bypass traditional detection methods. In healthcare environments, these checks can reveal behaviors such as excessive patient record access outside an employee’s department, viewing inactive or discharged patient files without clinical justification, or repeated failed attempts to enter restricted areas of the electronic health record (EHR).
Other indicators of insider threat behavior include upcoding practices, frequent overrides of clinical decision support alerts, and repeated generation of custom PHI reports. To strengthen detection, organizations should develop custom rules and reports tailored to operational workflows, enabling proactive identification of anomalous behavior.
Review application roles
Role-based access controls must be actively maintained to reduce the risk of privilege misuse. Do not apply the “set and forget” approach. Organizations should monitor role assignments at least annually to confirm the roles remain appropriate and accurate. During the review, it is important to validate that only active workforce members have access to the application and ensure that role-based access controls within the application adhere to enterprise policy. These measures help maintain least-privilege principles and prevent unauthorized access that could lead to security or compliance incidents.
Train personnel
Even with these technical controls and advanced security tools in place, a significant gap remains - training. One frequently overlooked component is the lack of training for managers and SOC analysts on how to recognize insider threats. It's not enough to simply collect the application data. The personnel reviewing the data must understand the context and motivations behind abnormal behavior, and to “think like a bad guy.”
To close this gap, role-based security awareness training should go beyond phishing simulations and basic hygiene. It should include education on insider threat patterns and techniques. When paired with effective monitoring tools, well-trained analysts and managers are better equipped to recognize suspicious events. Ultimately, the most advanced security tools are only as effective as the people trained to use them.