"Insiders” in the Supply Chain

An insider is not necessarily a criminal from the beginning

TT Club's cargo-theft claims show rising insider exposure. Suspected insider involvement appeared in about 10% of its 2024 theft claims and increased to 14% in the 2025 dataset. At the same time, fraudulent-carrier activity represented 32% of 2025 claims, demonstrating how external crime and internally exposed information can reinforce one another.

CISA defines insiders more broadly than employees who deliberately commit crimes. Anyone with authorized access, knowledge or privilege can create harm intentionally or unintentionally. In logistics, a worker selling pickup details is a malicious insider; an employee emailing manifests to a personal account may be negligent; a compromised contractor account can provide an outsider with insider-level access.

The central danger is knowledge advantage. Insiders may know which shift is lightly staffed, where cameras have blind spots, which loads carry the highest value, where high-value stock is stored, when trucks arrive, which carriers are approved and who is permitted to override normal procedures. That knowledge allows criminals to target the exact weakest point rather than probe the system repeatedly.

Outsourcing further expands the definition of inside. A warehouse can include permanent staff, temporary labor, outsourced security, cleaners, maintenance teams, IT vendors, carriers and brokers that all use the same physical or digital environment. If access persists longer than the business need, the attack surface grows even when no one intends wrongdoing.

The correct starting point is therefore not suspicion of people but system design. Every privilege can be abused, mishandled or compromised. Controls should be based on role, purpose, location, time and evidence rather than on familiarity or the assumption that an internal user is automatically trustworthy.

Zero trust has to extend from accounts to warehouse doors

NIST defines zero trust as an approach that does not grant implicit trust simply because a user or device is inside the enterprise network or owned by the organization. Access must be authenticated and authorized for the resource being requested. In logistics, the principle can extend beyond cybersecurity to warehouse gates, loading docks, seal rooms, control towers and shipment data.

The first rule is least privilege. A picker does not need the full commercial value of every shipment; a driver does not need manifests for unrelated loads; a maintenance contractor does not need access to inventory maps; a temporary worker does not need an account after the shift ends. Privilege should match role, location and time window.

The second rule is segregation of duties. One person should not be able to create a carrier, change bank details, approve pickup and release cargo. For high-value shipments, changes to driver, tractor, destination or payment information should require a second approval or independent callback. Dual control makes it harder for one insider to convert access into a completed loss.

The third rule is logging and anomaly detection. Organizations should know who opened a manifest, downloaded a customer list, entered a warehouse zone after hours, changed pickup instructions or overrode a seal discrepancy. An account viewing dozens of unrelated shipments or a badge entering an unauthorized zone should create an alert, not simply a historical log.

Finally, access needs lifecycle control. Privileges should be recertified and removed immediately when an employee leaves, a contractor finishes a project or a vendor changes personnel. Shared accounts and anonymous badges destroy accountability. Zero trust works only when every sensitive action can be traced to a specific identity.

Insider risk in logistics should be constrained by six layers: least-privilege access; segregation of duties; dual approval for sensitive changes; logging and anomaly alerts; periodic access reviews; and immediate offboarding when a role ends. The objective is not to create a workplace of suspicion or unnecessary blanket surveillance of staff. It is to design operations so that one person - whether malicious, careless or compromised - cannot independently create a major loss.

Multi-tier outsourcing requires stronger access governance

Vietnam's logistics structure makes insider risk especially relevant because operations are frequently outsourced through several tiers. A cargo owner uses a 3PL, the 3PL appoints a carrier, the carrier subcontracts capacity, warehouses employ temporary labor and security providers, while IT platforms may be operated by separate vendors. Each participant can hold credentials, badges, shipment data or physical authority.

For electronics, pharmaceuticals, metals, luxury goods and other high-value cargo, information should be classified on a need-to-know basis. Not every participant needs the cargo value, exact storage location or complete route. Operational information can be separated into layers and released only when the relevant task begins.

Warehouses can apply zone-based and time-based access. Picking staff should enter only assigned zones; high-value cages can require dual authentication; contractors can receive access only during maintenance windows. Cameras remain useful, but greater value comes from linking CCTV, badge logs, WMS events and gate records into a single audit trail.

Carrier governance should also move beyond a company-level approved list. Driver and vehicle identities need verification for each pickup. A last-minute change in dispatcher, tractor, trailer, plate or pickup time should trigger step-up verification. This reduces the ability to use legitimate internal information to construct a pickup that appears normal.

Communication channels matter as well. Manifests, cargo values, passwords, seal codes and pickup instructions should not circulate broadly through uncontrolled personal messaging groups. Controlled channels with permissions, retention and auditing reduce the risk of accidental forwarding and make abnormal information access easier to investigate.

HR and security functions need to collaborate, but insider programs should not become employee-hunting exercises. CISA recommends a prevention-focused, multidisciplinary approach combining policy, awareness, management practices and reporting. A workplace where employees can report anomalous access or process deviations without automatic blame is more likely to detect risk early.

Security KPIs should finally shift from simply recording whether cargo was lost to measuring control health: orphan accounts, excessive privileges, overdue access reviews, sensitive changes without second approval and terminated users whose credentials remain active. These indicators reveal weakness before a theft becomes the first visible sign of failure.

Insider risk is a reminder that supply chains are not protected by walls, locks and GPS alone. An organization can be strongly defended from outside and still remain fragile if internal access is broad, persistent and poorly logged.

Modern supply chains need a simple principle: trust should be re-established for every sensitive action. When physical access, digital identity and operational authority are governed together, trust is less likely to become a vulnerability.

By Dang Phong