A public-works employee with legitimate GIS access copies sensitive infrastructure layers to personal media shortly before resigning. Which threat category does this primarily illustrate?
Select an answer to reveal the explanation.
Short Explanation
The danger here already had a badge and a map login. Insider threat is when trusted access turns sideways—copying GIS layers on the way out the door is not the same problem as a cold phishing email from outside.
Full Explanation
A public-works employee who already holds legitimate GIS access and copies sensitive infrastructure layers to personal media before resigning exemplifies insider threat. The defining features are authorized access and privileged organizational knowledge turned to unauthorized data removal. External perimeter controls may never see a phishing lure because the actor did not need to break in—only to abuse trust that the city already granted.
External phishing that never required internal credentials does not match an employee using existing map logins. Unskilled external scanning of public website certificates is reconnaissance from outside and does not involve privileged GIS layer theft. Shadow IT—buying an unsanctioned SaaS tool—creates unmanaged services; it is a governance and attack-surface issue, not deliberate privileged data removal on the way out the door.
Exam caveat: insider threat hinges on misuse of legitimate access, whether malicious or negligent in related scenarios; here the unauthorized copy is the clear abuse. Operational check: apply DLP and egress monitoring on sensitive GIS repositories, revoke access promptly at resignation triggers, use just-in-time privileged access, watermark or inventory critical layers, and review anomalous bulk downloads by staff near termination dates.