Using Firewall Logs to Prevent Insider Threats

Lessons Learnt This Week as a Cyber Consultant

Okay, you got me just after my third coffee, so let me squeeze this out of me before the jitters set in: Insider threats? They wake me up at night more than the Slammer worm ever did in 2003. I’ve been in this game since I was a network admin in ’93, mucking with PSTN voice and data multiplexing (ah, the good old days of dial-up and clunky switches). And now running a company called PJ Networks Pvt Ltd, where I literally help clients — banks most recently — nail down zero-trust architectures, I now know plenty about how to sniff those bad actors out of inside your own walls, thanks to something that everyone else seems to ignore, firewall logs.

Here’s the thing — firewalls do more than serving as traffic cops keeping the bad guys out. They’re your early warning system for undercover insider moves, too. The enemy is not always that shadowy hacker overseas; sometimes it’s your own insider, whether malicious or sloppy. In this article, I’ll guide you on how you can use firewall logs to fight against insider threats.

Identifying Insider Threat Behavior

I often thought of insider threat detection as cooking a complex biryani — you need the right mix of ingredients and timing to get that perfect flavor or in this case, security. Identifying poor behavior within your network is not about Catch-22 psychology; it’s about patterns.

Common insider warning signs in a firewall log:

• Unusual times of multiple failed login attempts followed by successful login (somebody walking around jackknifing door handles in the dark)
• Outbound traffic surge from a normally quiet user (suspicious gravy dumps)
• Access to resources not appropriate for their job role (think your accountant suddenly accessing the HR folder)

A nugget out of my PJ Networks vault, One of the banks we assisted recently, identified a user who was logging into work after hours, accessing the network, and sending data out during late hours. Logs from the firewall revealed that they connected to unusual external IP addresses over encrypted channels. The takeaway? Insider threats are sometimes wolves in sheep’s clothing and you need to detect the pattern, not just the deed.

Watching for Unusual Access Attempts

This is something I have to tell you — it’s critical. When you’re locked inside firewalls, you learn very fast that every single failed or odd access attempt lands on your radar screen. Your firewall log is the black box of a vintage car; it has data on every turn, every brake, every dash you’ve taken. So, god knows, not acknowledging weird attempts is like failing to notice the check engine light.

Watch for things like:

• Failed login attempts — not a random typo, but a systematic effort to guess your password
• Access requests during off business hours — not every night owl is a hacker, but many hackers are night owls
• Unknown or unrecognized devices connecting to the network
• Switching rapidly between different systems or different servers in a short period of time (sounds like a hacker’s recon mission, right?)

Quick rant here: The over-reliance on just password complexity(!?!) to defeat these attempts makes no sense to me. If there is a pattern as you see point by point in your firewall logs of brute force or credential stuffing, then it is of no use. Detection and response, not just requiring the users to create passwords the length of a novel.

Detecting Data Exfiltration

Data leaks inside your walls. The stuff that keeps me up. If a firewall bashed some outsider over the head for trying to hammer your network, then great. But that fire really begins when one of your own — or someone with access to the inside — starts siphoning off your data quietly.

Monitoring firewall logs is a bit like watching your kitchen’s backdoor; the front door (your perimeter firewall) security is solid, but an open window?

So here are a few tips that helped me:

• Track outbound data volumes carefully. While sudden, large data transfers aren’t always bad — backups are a thing — unexpected ones? Worth an investigation.
• Check for links to anomalous or blacklisted IP addresses. Particularly cloud storage services your org doesn’t formally use, or those not based within the country.
• Monitor encryption patterns and VPN tunnels — insiders occasionally obfuscate their data transfers under legitimate tunnels.
• Create a baseline normal activity for each user. Anything far outside of that baseline is suspicious, he said.

On one bank client, a junior employee angry about a promotion began stealing customer records over a VPN tunnel that shows up in the firewall log. Since their spotted logs helped them spot it early — a potential millions-loss avoided.

Linking Logs and Indicators to User Behavior

Firewall logs that are only speaking to IT kinda people are not enough. In that enterprise, to actually sniff insiders, your logs need to talk to user behavior analytics — you need to connect the dots.

Think of your firewall logs as thousands of puzzle pieces. Alone, a piece is just noise. Combined with user authentication logs, device access records, and endpoint alerts, you can catch sketchy behavior that wouldn’t be otherwise possible.

So, here’s what I do when I’m running these correlations for clients (trust me, it gets results):

• Correlate firewall events with specific user accounts and roles. This helps flag if someone who has access to a server suddenly runs anomalous queries.
• Integrate with SIEM solutions, thus allowing alerts to benefit from cross-system visibility. Firewalls are a data silo by itself.
• Implement behavioral baselining to identify when a user’s activity acts out of character — such as if a user downloads large sets of data at 2 a.m. for the first time in years.

You wanna know a secret? Most organizations own these logs but misuse them. For Christ sake, I used to do that — kept logs for compliance. Now? They’re my best asset in early breach detection.

Receiving Alerts for Insider Threats

But firewall logs can be vast — and most teams don’t have the bandwidth to sift through them constantly. Which is why at PJ Networks we are all about automation (not some over bloated AI nonsense) and intelligent alerting.

The basis for good insider threat alerts from logs:

• Set thresholds for aberrant behaviors — e.g., >5 login failures in 10 mins, or data transfer > X GB.
• Notify when accessing sensitive resources after business hours. Legitimate maintenance? Okay — but you had better have it logged.
• Layer escalation paths — from email alerts to SMS or dashboard alarms for risks.
• Tuning alert rules on an ongoing basis! There is no set-and-forget when it comes to insider threat detection. You have to adjust based on what you learn over time.

One bank rollout layered firewall log alerts with endpoint monitoring and user access logs to achieve a zero-trust environment where insider threats couldn’t hide. In the first year, they had already cut insider-related incidents by more than 60%. No magic — simply using logs and alerting smartly.

Quick Take

• Insider threats lurk within plain sight — your firewall logs contain the clues.
• Look for unusual access times, failed logins and strange outbound traffic patterns.
• Annals firewall logs against users behavior to generate high context.
• Establish and configure intelligent alerts — don’t let yourself become overwhelmed by log noise.
• Zero-trust + proactive log monitoring = A good bet against insiders.

Takeaways Before I Have My 4th Coffee

Through my 30 years in networking and security (and yes, surviving Slammer and watching dial-up recede into history), if there’s one thing I can tell you, it’s that your firewall logs are your underappreciated first responder. They’re not glamorous or shiny tech toys — but they’re the old reliable sedan you take on every cybersecurity road trip.

Be wary of those who want you to pay for AI-powered everything when they folk haven’t even learned the basics. Logs and firewalls still have great power — if you know how to read them. And as far as insider threats go? Your logs could mean the difference between a harmless scare and a full-blown data leak.

If you’re running a network — and particularly if you’re in finance or banking — investing in thorough firewall log monitoring and integrating that into your insider threat strategy has to be top of mind. From one cybersecurity geek to another: If you haven’t already, don’t wait for a breach to pay attention.

Talk to you later — before that caffeine crash sets in.

Sanjay Seth
Founder, PJ Networks Pvt Ltd
1993–Present CyberSecurity Consultant

P.S.

(And if you want to get nerdy about hardware hacks (I just got back from DefCon’s Hardware Hacking Village and it’s still buzzing), or chat zero-trust upgrades — hit me up.