Today’s organisations face new opportunities and challenges nearly every day as the world around us continues to evolve. But perhaps one of the greatest challenges organisations still encounter is how to navigate the changes associated with today’s remote and hybrid workforce. After all, the work-from-anywhere world has enabled data to be accessed from quite literally anywhere. This, combined with the growth of organisation’s usage of contractors, freelance “gig workers”, and third-party supply chain partners, means more people are accessing your organisation’s network and data than ever before.
Organisations need to adopt a new mindset to efficiently adapt to this new normal, one that enables a transformation of their insider threat management strategies. It starts by understanding the insider threat risk.
Understanding the Insider Threat Risk
Insider threats are present in every organisation in every industry. Despite this, organisation still tend to overlook the impact of an insider threat. Yet, the definition of an insider has expanded significantly as a result of businesses becoming more digitally and globally interconnected.
Your Greatest Insider Threat Risks
Not all insiders are created equal. Some pose more risk to the organisation than others. For this reason, many organisations often assume malicious insiders are the only threat profile they need to be mindful of. Yet malicious insiders comprise just 26% of all insider threat incidents.
There are actually three primary threat profiles organisations must know about and prepare for:
- Malicious insiders - Users who intentionally cause damage or steal from an organisation, usually motivated by greed, revenge, or a sense of entitlement.
- Negligent insiders - Users who unintentionally make mistakes that create an increased risk of data loss.
- Compromised insiders - Users who have been successfully targeted by social engineering or malware to steal their login credentials and/or take control of their devices.
Below are common business scenarios that make organisations more vulnerable to insider threats. These examples often result in higher risks of data loss from insiders:
Remote Employees, Contractors and Third-Party Vendors
Though remote work opportunities have enabled organisations to consider expanding their talent pool for greater hiring opportunities, it doesn’t come without risk. Until now, organisations have primarily relied on perimeter-based security solutions to keep sensitive data secure within the organisation’s four walls. But today’s world doesn’t operate in a traditional office environment.
The introduction of more collaboration tools and leaning on those tools to share sensitive assets in order to get work done, heightens the risk of both careless mistakes and malicious behaviour.
Organisations should monitor for signs of potentially risky behaviour, including installing unauthorised software (also known as shadow IT), sharing files with unauthorised users, and logging on from different endpoints. This is particularly important to monitor, especially in the case of contractors and partners whose privileges should be limited to the minimum amount of access needed to do their jobs and turned off once they no longer need it.
Departing Employees
Departing employees are, perhaps not surprisingly, extremely high-risk users. Though their motivations can often be innocent — like taking a copy of a presentation or report they created that they were particularly proud of — it doesn’t eliminate the risk of data loss or rule out the potential for malicious activity around IP theft.
For example, a departing employee may look to steal trade secrets and bring them to their new employer. They may use cloud storage services, personal email, or removable media to exfiltrate data.
Similar to the warning signs of potentially risky behaviour in remote employees, departing employees should also be monitored for activity during their offboarding time. This holds particularly true for high-risk users (potentially malicious behaviour) and privileged users who may unintentionally increase risk of data loss.
Worth noting is that much of this could be mitigated with an official offboarding process. In some cases, organisations don’t promptly disable access to corporate applications and systems even after termination, leaving the door open for former employees to access sensitive data.
Mergers & Acquisitions
Conducting a merger or acquisition can be an extremely arduous process, one that requires significant diligence to minimise the risks associated with a slew of challenges that could arise. One such challenge is managing data risks.
Risk and compliance teams need to know who has interacted with sensitive information to ensure both parties are aware of any risks before the deal is closed. And once the deal closes, it’s critical to have visibility into the varying degrees of employee security awareness and hygiene.
Though managing data security can be challenging in its own right, complex personnel issues that come from a merger or acquisition exponentially increase data loss risk. If employees depart voluntarily or are laid off, they may attempt to take sensitive information with them, and disgruntled employees might attempt to defraud the organisation or its customers.
Rethinking Your Approach to Insider Threat Management
Implementing an effective Insider Threat Management programme in your organisation ultimately comes down to this simple truth: Data doesn’t move itself. People move data, and their reasons can be varied. This is why it’s so important to build a modern approach to data loss prevention that uses a people-centric security model. Doing so enables organisations to be more effective when it comes to preventing an insider-related data loss incident.
Learn more about how to take a people-centric approach to implementing your Insider Threat Management programme by reading our eBook Modern Blueprint to Insider Threat Management.