The Enemy Inside

External hackers get headlines. Insider threats cause bigger losses:

• Traders front-running client orders
• Engineers with key access absconding
• Admins manipulating order routing

External attack: Must breach perimeter
Insider attack: Already inside, trusted

Order flow is the crown jewel. This lesson covers protecting it.

---

What You’ll Learn

By the end of this lesson, you’ll understand:

1. Insider threat vectors - Who can do what damage
2. Separation of duties - No single person can steal
3. Monitoring patterns - Detecting suspicious behavior
4. Secure execution - Order path hardening

---

The Foundation: Order Flow Value

Why insiders target order flow:

• Front-running: Trade before large client orders
• Copy trading: Mirror smart money without permission
• Order routing: Send flow to exchanges that pay rebates
• Information sale: Sell order intent to competitors

Client submits $10M buy order
Insider sees order before execution
Insider buys personally
Client order executes, price moves up
Insider sells at higher price
Client gets worse fill, insider profits

---

The “Aha!” Moment

Here’s the key security principle:

Trust but verify is backwards. Verify, then trust minimally. Every person with order flow access should have exactly the access they need, monitored continuously, with no ability to act alone on high-value operations. Assume anyone might be compromised.

Zero-trust applies to your own team.

---

Insider Threat Vectors

Role	Access	Threat
Trader	Order entry	Front-running, wash trading
Developer	Source code	Backdoors, key theft
Admin	Infrastructure	Route manipulation, data exfil
Analyst	Market data	Selling order flow info
Support	Customer data	Social engineering

---

Separation of Duties

No single person should be able to:

❌ Initiate AND approve a withdrawal
❌ Write trading code AND deploy it
❌ Access client orders AND personal trading
❌ Manage keys AND propose transactions

Multi-Party Approval

class OrderExecution:
    def execute_large_order(self, order: Order):
        if order.value_usd > 1_000_000:
            # Require second approval
            approval = self.get_second_approval(order)
            if not approval.verified:
                raise SecurityException("Large order requires 2 approvals")
        
        # Log before execution
        self.audit_log.record(order, approved_by=[order.creator, approval.approver])
        
        return self._execute(order)

Code Deployment Controls

# GitHub CODEOWNERS
/src/trading/* @trading-lead @security-team
/src/execution/* @execution-lead @cto @security-team

# Require 2 approvals for production
pull_request:
  required_reviews: 2
  require_code_owner: true
  dismiss_stale_reviews: true

---

Monitoring Patterns

Suspicious Behavior Detection

class OrderFlowMonitor:
    def analyze_trader_patterns(self, trader_id: str):
        # Pattern 1: Trading before large client orders
        personal_trades = self.get_personal_trades(trader_id)
        client_orders = self.get_client_orders()
        
        for trade in personal_trades:
            close_client_orders = [
                o for o in client_orders
                if o.symbol == trade.symbol
                and 0 < (o.timestamp - trade.timestamp).seconds < 60
                and o.side == trade.side
                and o.size > trade.size * 100
            ]
            if close_client_orders:
                self.alert("Potential front-run", trader_id, trade, close_client_orders)
        
        # Pattern 2: Unusual after-hours access
        access_logs = self.get_access_logs(trader_id)
        after_hours = [l for l in access_logs if l.hour < 6 or l.hour > 22]
        if len(after_hours) > 5:
            self.alert("Unusual access pattern", trader_id, after_hours)

Real-Time Alerts

ALERT_RULES = [
    {
        "name": "large_personal_trade",
        "condition": lambda t: t.is_personal and t.value > 100000,
        "action": "alert_compliance"
    },
    {
        "name": "after_hours_order_access",
        "condition": lambda e: e.type == "order_view" and not is_business_hours(),
        "action": "alert_security"
    },
    {
        "name": "unusual_route",
        "condition": lambda o: o.route not in APPROVED_ROUTES,
        "action": "block_and_alert"
    }
]

---

Common Misconceptions

Myth: “We hire trustworthy people, so insider threat isn’t a concern.”
Reality: Trust doesn’t scale, and circumstances change. Financial pressure, outside manipulation, or simple mistakes can turn trusted employees into threats. Controls protect even trustworthy people from false accusations.

Myth: “Monitoring employees is an invasion of privacy.”
Reality: Trading floor monitoring is legally required and industry standard. Employees in sensitive roles consent to monitoring. The alternative is undetected fraud.

Myth: “Two-person controls slow everything down.”
Reality: Two-person controls on high-value operations add minutes, not hours. The protection is worth the small delay. Automate everything else.

---

Order Path Hardening

End-to-End Encryption

# Encrypt order at source, decrypt at exchange connector
from cryptography.fernet import Fernet

class SecureOrderPath:
    def __init__(self, key: bytes):
        self.cipher = Fernet(key)
    
    def submit_order(self, order: Order) -> str:
        # Encrypt order data
        encrypted = self.cipher.encrypt(order.to_bytes())
        
        # Send encrypted to execution service
        return self.execution_service.execute(encrypted)
    
    # Only execution service can decrypt
    def execute(self, encrypted_order: bytes) -> str:
        order = Order.from_bytes(self.cipher.decrypt(encrypted_order))
        return self._send_to_exchange(order)

Audit Trail

-- Every order action logged immutably
CREATE TABLE order_audit_log (
    id SERIAL PRIMARY KEY,
    order_id UUID NOT NULL,
    action VARCHAR(50) NOT NULL,  -- created, modified, executed, cancelled
    actor VARCHAR(100) NOT NULL,
    timestamp TIMESTAMP DEFAULT NOW(),
    before_state JSONB,
    after_state JSONB,
    ip_address INET,
    session_id VARCHAR(100)
);

-- Insert-only, no updates or deletes
REVOKE UPDATE, DELETE ON order_audit_log FROM trading_app;

---

Practice Exercises

Exercise 1: Design Controls

Scenario: Trader with personal trading account

Design controls to prevent front-running:
1. What information access restrictions?
2. What monitoring rules?
3. What approval processes?

Exercise 2: Detection Rules

Write detection logic for:
1. Employee trading same symbol as client within 5 minutes
2. Order routing to non-approved exchanges
3. Unusual query volume on specific accounts

Exercise 3: Incident Response

Alert: Trader accessed 50 client order records at 11PM

What's your response?
1. Immediate actions
2. Investigation steps
3. Preservation requirements

---

Key Takeaways

1. Insiders have access-that’s the threat - Controls assume compromise
2. Separation of duties - No one person can steal
3. Monitor everything - Detect anomalies in real-time
4. Audit trails are sacred - Immutable, complete, reviewed

---

What’s Next?

🎯 Continue learning: Security Architecture for Trading

🔬 Expert version: Order Flow Security

Now you can protect order flow from internal threats. 🛡️