Malicious employees may get the most publicity for insider threat types, yet it’s the staff members who jeopardize your company unknowingly who pose the real threat. We’re talking here about the “mistake-makers”, they who fall for the phishing emails, giving the hackers the system access; the ones who, through lack of attention or through lack of training, exploit or give out sensitive data or deleting or modifying it in error.
Negligent employees in fact were the cause of triple the number of security incidents (64%) than those of malicious employees (23%), according to Ponemon Institute’s 2018 Global Cost of Insider Threats Study. Cost-wise a security incident caused by a negligent employee cost their employers an average of $283,281 per incident, which translates to an average annual cost of this negligence of $3.81 million. On the other hand, actual criminal or malicious employees cost their employers less – at $2.99 million. Furthermore, time-wise, insider incidents require 73 days to be brought under control, according to this study.
Yet a trusted business partner, a supplier, or a contractor with unchecked access to either sensitive data or systems can do irreparable damage in a company. In other words, the reality is, unfortunately, that these “insiders” aren’t always an employee.
How then to protect your company?
Secure your company with these five easy steps
Revolutionary Security suggests CISOs take the below steps to beat insider threats.
Recruit carefully
How you hire is the first step towards stopping insider threats. Together with your HR department, you need to fully vet potential recruits, carrying out background checks (comprising of civil litigation and criminal records) and request references to check up on how employees behaved during their past employment.
Update your training regarding security awareness
Having a workforce that is fully trained is another defense against insider threats. The average training program gives a 37-fold return on investment, according to a Ponemon anti-phishing training program survey. Full training should alert employees to untoward behavior, which points to insider threats, in their colleagues – as well as knowledge on how to deal with and who to escalate their concerns to.
Set down and/or bring Company policies up to date
Your company’s policies on the security of their intellectual property and other assets as well as responsible sharing, need to be put into place or updated. Traveling with laptops, work-related personal devices, accessing third-party email providers should also be implemented as well as managing likely or confirmed incidents.
Data Access – management and limit
The priority of every business should be to safeguard trade secrets, intellectual property, and customer information. To begin with, keeping an eye on the information employees can access. You can add another layer of security by limiting who can access cloud storage sites and 3rd party email providers. Preventing the usage of computer thumb drives and unpermitted software installation should also be carried out. Safeguard and limit access to information by installing enterprise mobility management solutions across apps and mobile devices. Toughen up remote employee protection (a vulnerable situation) with security solutions based in the cloud for their work online.
Data Usage and network activity monitoring
By keeping an eye on employee network data flows and the behavior of employees, an organization’s defenses are able to better counter insider threats. By monitoring, by way of programs for user analytics, organizations can follow the data access history and activities, thereby providing an assessment of the risk level. Analytics programs for behavior offer the most in cost savings compared to other tools.
To conclude then, data leaks are an expensive issue to resolve, whatever size or industry applies to your company. You can however minimize the risk of data leaks, loss, or theft if you put into place the above five steps.
