Describe a scenario where an insider threat is suspected at Shamrock Trading. What technical and administrative steps do you take to investigate?