Which of the following could be considered a possible indicator of an insider threat?
1) Unusual access patterns
2) Unauthorized data transfers
3) Frequent password changes
4) Strong encryption methods