Insider Threats

Insider Threats Are on the Rise

Insider threats grow more commonplace every day. So, it pays to have a solid understanding of the issue. Let’s start with defining an insider. An insider can be a current or former employee, a contractor, or a business partner. What’s critical is that they have, or had, authorized access to your network, systems, or data. For example, you might have given network access to a vendor or a supplier an access device.

The situation evolves into an insider threat when an insider intentionally, or even unintentionally, misuses access privileges to impact your information systems negatively. The reality is that 25% of all security incidents involve insiders (Verizon). Plus, one-third of organizations have encountered an insider threat incident.

Types of Insider Threats

Insider threats generally fall into three categories – compromised, malicious and negligent. With a malicious insider threat, the goal is inherently to cause damage. Malicious threats include sabotage, intellectual property theft, espionage, and fraud. Twenty-three percent of attacks fall under this category.

Compromised threats cover actors who have stolen legitimate credentials and pose as the authorized user. They use their accounts to exfiltrate sensitive data, often without users knowing the compromise. Roughly 13% of insider attacks correlate to compromised threats.

Accidental or negligent insider threats generally present as a mistake committed by an employee, with 67% of insider threats relating to phishing. Negligent insiders account for 64% of incidents, the most common among attacks. Common attacks include:

• Human error
• Bad judgment
• Phishing
• Malware
• Unintentional aiding and abetting
• Stolen credentials
• Convenience

As you might suspect, no organization is immune to either type of insider threat, although the financial services industry spends more to protect itself against insider threats. In addition, healthcare experiences more than its fair share of insider threats.

Departmentally, finance departments (41%), customer access departments (35%), and R&D departments (33%) face the most substantial risk for a cyber-attack.

The Numbers Surrounding Insider Threats

Interestingly, insider threat incidents get underestimated. But even with lower estimates, it’s clear the frequency of such attacks continues to escalate.

Insider threats jumped from 3,200 a year in 2018 to 4,700 in 2020, a 47% increase. Roughly 60% of organizations experienced more than 30 insider attacks yearly.

Here are some other compelling figures associated with insider threats:

• Last year, 60% of data breaches came from insiders
• More than two out of three incidents stem from negligence
• 55% of organizations identify privileged users as their greater risk
• 70% of organizations see an increased frequency of insider attacks
• 85% of organizations indicate they find it difficult to determine the actual damage of an attack
• It takes 197 days to identify a breach plus another 77 days to recover
• Fraud (55%), monetary gains (49%), and IP theft (44%) are the underlying reasons behind insider threat

More concerning are the costs associated with an insider breach. They’ll typically cost you more – estimates range from $270,000 to upwards of more than $20 million at large organizations.

Preventing Insider Threats

Based on a 2021 report by Cybersecurity Insiders, the lack of security monitoring may increase insider incidents. Organizations surveyed paid little attention to monitoring behaviors for anomalous activity:

• Just 28% of firms used automation to monitor user behavior
• 14% of firms fail to monitor user behavior at all
• 28% of firms only monitor access logs
• 17% of firms only monitor specific user activity under particular circumstances
• 10% of firms only monitor user behavior after an incident has occurred

An initial consideration for stemming threats is better monitoring. But, apart from that, here are other ways you can reduce your risk:

Conduct a Risk Assessment

You should start by documenting critical assets, their vulnerabilities, and threats associated with them. Then, prioritize the risks and enhance your IT security to mitigate your highest risks. Finally, you can sign up for a free vulnerability assessment.

Document and Enforce Policies and Controls

Establish appropriate policies like general data protection regulations, third-party access, password management, etc. Ensure those policies present the actions to be taken and penalties applied if violated. Your policies should also explain what can and cannot be shared.

Establish Physical Security

You can’t be too safe when it comes to third-party security. Don’t allow suspicious individuals to enter critical areas. Inspect visitors for IT devices when entering buildings. In short, keep employees and third-party resources away from critical infrastructure.

Implement Layered Protection

The fact is no one security measure protects your business adequately. Instead, using layers of security delivers your most significant level of protection. That means, for example, deploying endpoint security best practices, intrusion prevention, encryption, privileged access management, data loss prevention, and more.

Detect Account Compromises

Compromised accounts create a threat inside your walls. So, reduce your threat by detecting compromised accounts. In addition, quickly detect unauthorized access to prevent you from dealing with a severe cyber incident.

Enforce Proper Password and Account Management Policies

Each user should have a unique login ID and password support with multi-factor authentication. At the same time, deploy role-based access to prevent employees from accessing data or services unrequired for their jobs.

Monitor and Control Remote Access

Deploy wireless intrusion detection and prevention systems. Monitor access requirements – remove them promptly when an employee leaves your company or no longer requires access to a given area. For that matter, purge any dormant or orphan accounts.

Monitor and Audit Employee Actions

Monitoring user behavior in real-time provides the most effective countermeasure to insider threats. First, use a security information and event management system (SIEM) to log, monitor, and audit employees. Next, retain logs for incident investigation. Finally, consider implementing User and Entity Behavior Analytics (UEBA) to establish user and behavior baselines.

Identify Third-Party Risks and Establish Secure Agreements for Cloud Providers

Cloud services extend your attack surface area. Ensure you understand provider security measures and monitor any changes made in the cloud. Access to your systems by any third party requires careful monitoring and control.

Conduct Cyber Awareness Training

Train your employees on how to identify and avoid social engineering attacks. If a supplier has yet to train its employees, extend cyber awareness training to personnel working on your account. Unfortunately, training won’t eliminate malicious attacks. But it will go a long way to avoiding accidental security breaches.

Need Help Preventing Insider Threats and Cyber-Attacks in Your Company?

Our IT company has been helping small to medium-sized businesses for more than 15 years. So, you can count on our experience to guide you on almost any cybersecurity solution, including insider threats.

Today’s cybersecurity environment is more involved than ever. So don’t go it alone. We’ll deliver appropriate IT solutions that drive your IT success. For example, talk to us about managed IT services solutions or co-managed options.