Insider Threat (Fundamentals)
As discussed, the insider threats are not always bred out of malicious nature. In fact, many insider threats exist due to the unintended or accidental happenings.
More than 51% of companies are concerned about the unintentional insider attack. However, 49% of the companies are still worried about malicious insider, which do exist and are a major threat.
What constitutes the accidental insider attack, is the negligence of the employees, contractors, and other technical staff. Due to such behavior, there is an extreme risk of vulnerability to the IT assets such as a database, file servers, cloud applications, cloud infrastructure, endpoints, networks, active directory, business applications, and mobile devices. Among this data, the highest risk falls to the database (50%) and corporate file servers (46%).
The Root of the Problem
However, the biggest reason for exploited vulnerabilities via insiders are various ignored security practices. Some examples are similar passwords for many accounts, careless sharing of passwords, use of unsecured WiFi, and keeping devices without any password. But, the common cyber attacking technique “Phishing” is the prominent cause of insider threat too. 67% of the accidental insider threats are exploited through Phishing.
The employees unintentionally transfer important business data to the malicious individuals through fraudulent websites that pose as legitimate. These websites contain malvertisements (ads with malware) and hyperlinks to altered websites.
This extreme vulnerability manipulation is caused due to an uneducated employee team, unaware of appropriate security measures. The study of insider threats also shows that the main enablers of cyber attacks are numerous users with unrestricted and excessive access. Also, the decentralized storage of sensitive data on many devices, a higher amount of sensitive data and ignored employee training are significant enablers of insider threats.
The reach of concern is growing. In fact, 74% of the surveyed firms think that they are at risk of insider threat. The evidence to this is that the Ponemon Institute’s 2016 Cost of Insider Threats Study. This study reported that “among the total 874 incidents, the 568 were caused by the ignorance of employees and contractors, 85 by outsiders via credential access, and 191 by malicious insiders and hackers.”
Impact of Insider Threats
The Insider Threat Report 2017 shows that along the data loss, there could be an immense loss to monetary assets as well. According to this report, 53% of the surveyed firms claimed that they have to invest the remediation cost of around $100,000 or more. However, the 12% of respondents estimate this cost to be more than $1 million.
The 2018 Insider Threat Report claims a higher percentage, showing 66% of organizations who consider malicious insider attacks or accidental breaches more likely than external attacks. Also, there were a higher number of firms who consider insider threat more damaging than the external attack. But the question is why the organizations are unable to stop these threats even after acknowledgment?
Here are some probable reasons;
- Insider threats are very critical to detect, as most of them are unintentional and sudden. There could be years for which the insider threat could go undetected.
- Distinguishing a malicious approach among the regular work is also a difficult task. An employee working with sensitive data or credentials could be performing his routine task.
- Insiders or employees have an easy opportunity to mask their action if it is unintentional or due to a malicious approach. If an employee has privilege technological information, he/she could easily erase the signs of a vulnerability before anyone sees it.
- Lastly, if the management detects an insider threat, the employee can get away by claiming his/her act as a mistake. Due to such practices, regular employees, as well as the malicious insiders, develop a careless and fearless behavior.
Risk Controls and Detection
There are some measures through which you can detect and control the insider threats in your organization. However, the organizations reported that they have appropriate controls for insider threats. 73% of the organizations affirmed that they resist insider risks through data encryption, data loss prevention, identity and access management, endpoint and mobile security, and cloud access security. The most popular prevention methods were data encryption and data loss protection with 60% organizations pointing towards them as a protection.
As far as detection is concerned, there are various tools which help organizations and cyber security experts to detect and evaluate the insider threat. When asked about detection tools, the firms revealed more than one tool that they use. 63% of the respondents indicated intrusion detection and prevention (IDS/IPS) as the detection tool.
However, the others detection controls were log management, security information event management (SIEM), and predictive analysis.
There are some general measures you can take to minimize insider threats.
Risk Acknowledgment and Background Monitoring
Whenever you hire a new employee, make sure that you thoroughly check their background. This is not a complicated task. Most of the applicants have previous experience mentioned in their resume and you just have to contact the previous organization where they work. Or you can search the employee by name through Google search.
However, one must acknowledge the risk and only then can you place appropriate measures.
Gain Visibility to Employee Behavior
The most significant element of an insider threat vulnerability the employees who excessively handle organizational data. You can have a good idea of an employee’s approach through monitoring their behavior towards the organization and the tasks. If they are unhappy, could be a sign that they are up to something.
Now, this does not mean that any unhappy employee is a threat. But observation and monitoring can breed opportunities to dig deep and negotiate with the employee before any potential loss.
Restrict Access
Restricting access is a vital key to minimize every cyber threat. Giving less privileges limit the chances of malicious exploitation due to the fewer accounts and less privileged users. Therefore, you can reduce the chance of a mistake.
Additionally, you should monitor and control the access through centralized servers. Several things could help you maintain control. For instance, the use of unique and strong passwords, prohibiting the password sharing, and use of two-factor authentication all help you gain control.
Employee Training and Education
The last but most important factor of minimizing insider threats is to train your employees for the cybersecurity threats and the channels through which vulnerability could be entered.
Educating your organizational team for security practices is a necessary step. If the insiders are aware of their responsibilities and the ignorant behavior which can hurt the organization, they will conduct themselves with care and awareness.
Tags: Cloud, Cyber-attack, Cybersecurity, Encryption, hackers, Insider threat, IT, Malware, Mobile Security, Password, Phishing, Technology, WiFi
