This may come as a shock to the majority of the public but the amount of threats (as defined by CSOs, IT managers and security specialists) are found within the confines of the company itself. Yes, hackers do still exist and there are times when they succeed in their nefarious deeds and penetrate security measures and cause a breach. And, while this type of cyberthreat is the kind to be highlighted in the front pages of newspapers and magazines, it represents but a small fraction of cybersecurity threats to a company.
Whether they want to believe it or not, the biggest threat to the overwhelming majority of companies comes from within. Whether their actions were intentional or not, employees not hackers are considered to be larger threats to a company’s security. Most alarming is that these incidents of error are not decreasing, but are increasing steadily.
In a recent study by IBM, it was found that a third of all cyberattacks that a company faces can be directly linked to the actions of (or lack thereof) its employees. Disgruntled employees who often have access to sensitive, and even classified, data are a likely cause. These employees simply copy the data to a flash drive or upload it to a third party cloud service, and just like that the company’s security measures have been breached. These types of offenders are usually trained and know the ins-and-outs of the system enough to bypass its security protocols. These employees are methodical and act with deliberate intent, often having planned the heist for week or months ahead of time.
Then there are opportunists. These bad apples often stumble across a weak link in the security fence, quickly exploit it and harvest any and all data made available to them. They often do not know what to do with the data they just pilfered. If the data contains money that can be easily liquidated then that is the most likely course of action, however another likely event is that they would sell the information on the black market, which in this day and age is easily accessible via the Dark Web.
Finally, there is the last category which is a catch all for errors of omission. These can include anything from poor email handling strategies to bad decision making and phishing strategies. Basically, in this category employees do not intend to expose their company to a cyberthreat, but because they failed to pursue the correct course of action, they have basically let the fox in the hen house.
The bad news is that these are very real scenarios and the roles that insiders play in putting the company in danger is has been on a steep uptick. The good news, is that strategies can be implemented to decrease such incidents and even eliminate them altogether (in some cases). Errors of omission, while broader, may be the easiest to tackle, that is because there are protocols that can be created to plug the leaks and fortify the wall of security that surrounds a company’s systems. Email handling, web surfing and download protocols should be created and enforced throughout the organisation without exception. And yes, that includes the C-suite of executives.
The human component is a bit harder to deal with, as you never know when the “switch” will be flung in the minds of people. What may be a great and stalwart employee one day, may very well be a malicious hacker the next day. Compartmentalisation of systems and restricting access to those that have been cleared to do so will definitely decrease the amount of intrusions and internal hacks that occur. Furthermore, making things just a little bit harder to access is often all it takes to deter or hinder the opportunist from going through with the crime. By creating a blacklist of sharing software and cloud services that can be run on company devices, you are effectively decreasing the number of outlets with which a disgruntled employee can smuggle out company data. Employ deep analytics that are able to track who has accessed what files and directories, and it should be able to send out a warning if file transfers are taking place.
It should go without saying, but it is still worth to mention that the easiest way to prevent a lot of intrusions and cybersecurity threats is to implement a data security plan. Many would be surprised at how the implementation of even the most minimal of security measures is effective at deterring a great deal of threats, both externally and internally. The amount of threats your company is exposed to just gets smaller, the more layers of security are added. While this last piece of advice may seem like a “no-brainer”, the sad fact is that more often than not businesses choose to operate without even the most basic of cybersecurity measures.
While it may seem normal, even natural, for companies to keep their vigilant eyes looking outwards. They should pay an equal attention, if not greater, to the on-goings and threats that may come from within. So why then does it seem that only external attacks make the headlines? Well that’s because no company ever wants to admit that it hires criminals or those that can be perceived as criminals. There are public relations and optics to worry about after all. Now more than ever, companies must know or should know their employees on a much deeper level in attempt to discern their motives, intent and whether or not they are seeking to harm the company. This is not to say that company’s should not trust its employees, indeed doing so may very well lead to that company’s demise. However, the figures do not lie. Attacks are coming from within, and since companies are already investing in security to prevent attacks from without, it should not take that much more to implement measures from internal cyberattacks.
Guest Author - David Share
Director at Amazing Support
http://www.amazingsupport.co.uk/
David has held positions as Operations Director and Head of IT in legal and professional firms for more than 10 years. He is a Director and co-owner of Amazing Support, a Microsoft Silver accredited and specialist Managed IT Support and IT Services company. David actively helps SME businesses receive better Managed IT Support and IT Services in the London and Hertfordshire areas. He also assists overseas companies who are looking to expand their business operations into the UK and helps with their inward investment IT process. A professional member of The Chartered Institute for IT (BCS) and an event speaker promoting business start-ups and technology awareness. Married with a son, you will often see him riding his bicycle around the Hertfordshire towns! David regularly participates in charity bike rides for the British Heart Foundation.
