The Enemy Inside

External hackers get headlines. Insider threats cause bigger losses:

• Traders front-running client orders
• Engineers with key access absconding
• Admins manipulating order routing

External attack: Must breach perimeter
Insider attack: Already inside, trusted
```diff

Order flow is the crown jewel. This lesson covers protecting it.

---

## Order Flow Value

Why insiders target order flow:
- **Front-running**: Trade before large client orders
- **Copy trading**: Mirror smart money without permission
- **Order routing**: Send flow to exchanges that pay rebates
- **Information sale**: Sell order intent to competitors

```text
Client submits $10M buy order
Insider sees order before execution
Insider buys personally
Client order executes, price moves up
Insider sells at higher price
Client gets worse fill, insider profits
```bash

---

"Trust but verify" is backwards. The right model is: verify first, then grant minimum access, monitored continuously. Every person with order flow access should need a second party to act on high-value operations. Assume anyone could be compromised — financially, socially, or through a compromised machine.

Zero-trust applies to your own team.

---

## Insider Threat Vectors

| Role | Access | Threat |
|------|--------|--------|
| **Trader** | Order entry | Front-running, wash trading |
| **Developer** | Source code | Backdoors, key theft |
| **Admin** | Infrastructure | Route manipulation, data exfil |
| **Analyst** | Market data | Selling order flow info |
| **Support** | Customer data | Social engineering |

---

## Separation of Duties

No single person should be able to:

```text
❌ Initiate AND approve a withdrawal
❌ Write trading code AND deploy it
❌ Access client orders AND personal trading
❌ Manage keys AND propose transactions
```text

### Multi-Party Approval

```python
class OrderExecution:
    def execute_large_order(self, order: Order):
        if order.value_usd > 1_000_000:
            # Require second approval
            approval = self.get_second_approval(order)
            if not approval.verified:
                raise SecurityException("Large order requires 2 approvals")

        # Log before execution
        self.audit_log.record(order, approved_by=[order.creator, approval.approver])

        return self._execute(order)
```text

### Code Deployment Controls

```yaml
# GitHub CODEOWNERS
/src/trading/* @trading-lead @security-team
/src/execution/* @execution-lead @cto @security-team

# Require 2 approvals for production
pull_request:
  required_reviews: 2
  require_code_owner: true
  dismiss_stale_reviews: true
```diff

---

## Monitoring Patterns

### Suspicious Behavior Detection

```python
class OrderFlowMonitor:
    def analyze_trader_patterns(self, trader_id: str):
        # Pattern 1: Trading before large client orders
        personal_trades = self.get_personal_trades(trader_id)
        client_orders = self.get_client_orders()

        for trade in personal_trades:
            close_client_orders = [
                o for o in client_orders
                if o.symbol == trade.symbol
                and 0 < (o.timestamp - trade.timestamp).seconds < 60
                and o.side == trade.side
                and o.size > trade.size * 100
            ]
            if close_client_orders:
                self.alert("Potential front-run", trader_id, trade, close_client_orders)

        # Pattern 2: Unusual after-hours access
        access_logs = self.get_access_logs(trader_id)
        after_hours = [l for l in access_logs if l.hour < 6 or l.hour > 22]
        if len(after_hours) > 5:
            self.alert("Unusual access pattern", trader_id, after_hours)
```text

### Real-Time Alerts

```python
ALERT_RULES = [
    {
        "name": "large_personal_trade",
        "condition": lambda t: t.is_personal and t.value > 100000,
        "action": "alert_compliance"
    },
    {
        "name": "after_hours_order_access",
        "condition": lambda e: e.type == "order_view" and not is_business_hours(),
        "action": "alert_security"
    },
    {
        "name": "unusual_route",
        "condition": lambda o: o.route not in APPROVED_ROUTES,
        "action": "block_and_alert"
    }
]
```sql

---

## Common Misconceptions

**Myth:** "We hire trustworthy people, so insider threat isn't a concern."
**Reality:** Trust doesn't scale, and circumstances change. Financial pressure, outside manipulation, or simple mistakes can turn trusted employees into threats. Controls protect even trustworthy people from false accusations.

**Myth:** "Monitoring employees is an invasion of privacy."
**Reality:** Trading floor monitoring is legally required and industry standard. Employees in sensitive roles consent to monitoring. The alternative is undetected fraud.

**Myth:** "Two-person controls slow everything down."
**Reality:** Two-person controls on high-value operations add minutes, not hours. The protection is worth the small delay. Automate everything else.

---

## Order Path Hardening

### End-to-End Encryption

```python
# Encrypt order at source, decrypt at exchange connector
from cryptography.fernet import Fernet

class SecureOrderPath:
    def __init__(self, key: bytes):
        self.cipher = Fernet(key)

    def submit_order(self, order: Order) -> str:
        # Encrypt order data
        encrypted = self.cipher.encrypt(order.to_bytes())

        # Send encrypted to execution service
        return self.execution_service.execute(encrypted)

    # Only execution service can decrypt
    def execute(self, encrypted_order: bytes) -> str:
        order = Order.from_bytes(self.cipher.decrypt(encrypted_order))
        return self._send_to_exchange(order)
```text

## Audit Trail

```sql
-- Every order action logged immutably
CREATE TABLE order_audit_log (
    id SERIAL PRIMARY KEY,
    order_id UUID NOT NULL,
    action VARCHAR(50) NOT NULL,  -- created, modified, executed, cancelled
    actor VARCHAR(100) NOT NULL,
    timestamp TIMESTAMP DEFAULT NOW(),
    before_state JSONB,
    after_state JSONB,
    ip_address INET,
    session_id VARCHAR(100)
);

-- Insert-only, no updates or deletes
REVOKE UPDATE, DELETE ON order_audit_log FROM trading_app;
```diff

---

## Practice Exercises

### Exercise 1: Design Controls
```python
Scenario: Trader with personal trading account

Design controls to prevent front-running:
1. What information access restrictions?
2. What monitoring rules?
3. What approval processes?
```text

### Exercise 2: Detection Rules
```text
Write detection logic for:
1. Employee trading same symbol as client within 5 minutes
2. Order routing to non-approved exchanges
3. Unusual query volume on specific accounts
```text

### Exercise 3: Incident Response
```yaml
Alert: Trader accessed 50 client order records at 11PM

What's your response?
1. Immediate actions
2. Investigation steps
3. Preservation requirements

---

Key Takeaways

1. Insiders have access-that’s the threat - Controls assume compromise
2. Separation of duties - No one person can steal
3. Monitor everything - Detect anomalies in real-time
4. Audit trails are sacred - Immutable, complete, reviewed

---

What’s Next?

Continue learning: Security Architecture for Trading

Expert version: Order Flow Security