Keys to the Kingdom: Insider Threat for Small and Mid-Size Businesses
Most small businesses will never have a dedicated insider threat team, but they can still make insider theft harder and easier to catch. AJ King and Joel Cabrera of Hunter Strategy join Matt to talk platform hardening, data labeling, and access audits.
Small and mid-size businesses rarely have anyone whose full-time job is insider risk. The work usually lands on IT, a facility security officer, or someone in finance or legal, on top of everything else they do. Host Matt Triner talks with AJ King, Chief Information Security Officer at Hunter Strategy, and Joel Cabrera, Security Operations Lead at Hunter Strategy, about what these businesses can realistically do once basics like MFA and logging are in place. They also cover data labels that follow files outside the organization, canary files, access audits, and why culture matters more for spotting warning signs than for preventing them.
This Is Fine is the cybersecurity podcast by Hunter Strategy. Where we take the chaos seriously, just not ourselves.
In this episode
- Joel’s one-line version of the whole episode: don’t let any single person hold all the keys to your kingdom. Separation of duties comes first.
- AJ’s starting point is hardening your main collaboration platform with the vendor’s own guidance. That means blocking users from authorizing unapproved SSO apps, getting rid of shared credentials, managing service accounts, and enforcing MFA on every user.
- AJ explains why he prefers Microsoft for small businesses. Secure Score links each finding to the documentation or the setting that fixes it, and Defender, Intune, and Autopilot together provide endpoint telemetry without buying a separate EDR product. Joel notes that Google’s hardening checklists are a different kind of list rather than a missing one.
- Joel’s advice for a growing business is to deny all cloud apps by default, then use procurement records to allowlist only what the company has actually bought.
- AJ has watched a Purview-labeled document check back with Microsoft and refuse to open after the user’s credentials were revoked, even after it was copied to a USB drive. He pairs that with canary files, such as a decoy salary report, that get closely monitored.
- Matt pushes back on the idea that good culture prevents insider threats. Indicators stack up: a new car, open resentment toward the company, a gambling debt. In his view, a healthy culture gives peers enough visibility to notice those signs.
- The panel’s closing basics are regular user access audits and disciplined joiner, mover, and leaver processes, so that access doesn’t accumulate over time.
Chapters
- 00:00 Intro
- 00:34 : Why insider threats matter to small businesses
- 02:40: Separation of duties and shared risk
- 04:09: How attackers exploit third parties
- 05:57: Prevention, detection, and security basics
- 06:55: Hardening Google Workspace and Microsoft 365
- 10:13: Protecting crown jewels and sensitive data
- 12:05: Microsoft’s integrated security tools
- 14:06: Data labeling and raising the bar for data theft
- 15:42: Company culture and insider threat indicators
- 19:35: Practical controls and implementation challenges
- 20:44: Identity management and regular access audits
- 22:16: Data protection, network segmentation, and zero trust
- 25:12: What counts as a small or medium business?
- 28:50: Who owns insider threat mitigation in an SMB?
- 31:44: Low-maintenance controls and offboarding access
Mentioned in this episode
- Microsoft Secure Score (Microsoft’s security posture score, with step-by-step recommended actions)
- Google Workspace security checklists (Google’s best-practice checklists for small businesses and larger organizations)
- Microsoft Purview sensitivity labels (classification and protection settings that travel with files and email)
- Microsoft Defender for Endpoint (Microsoft’s endpoint detection and response platform)
- Microsoft Intune (cloud-based device and app management)
- Windows Autopilot (automated setup and enrollment for new Windows devices)
- Mandiant (threat intelligence and incident response firm, now part of Google Cloud)
- IANS Research (security research and advisory firm whose briefing AJ references)
- Darknet Diaries (Jack Rhysider’s podcast on true cybercrime stories)
- NAICS codes (industry classification codes used to set small business size standards)
Guests: AJ King, Chief Information Security Officer, Hunter Strategy; Joel Cabrera, Managing Director, Cyber Fusion Center, Hunter Strategy
Host: Matt Triner, CEO, Hunter Strategy
Each episode brings in practitioners from across federal and commercial work to talk through what it actually takes to keep the lights on in security, technology, and government contracting.
New episodes drop Thursdays. Subscribe wherever you listen.
