We’ve all heard the horror movie trope, “The call is coming from inside the house!”. While that may be a tool to build suspense in the movies, it’s more accurate than you think for business cybersecurity. The biggest threats to cybersecurity in your business aren’t faceless internet hackers. They’re the people that are already inside your business. The new Ponemon report on insider threats brings some interesting data points to light as it explores this often-overlooked facet of cybersecurity.
Recognize that insider threats generally come in two broad varieties: the Accidental Threat and the Intentional Threat.
Accidental Threats are not malicious, but they are pernicious.
Reported to be the cause of 62% of the surveyed incidents, they can result from carelessness, misunderstandings, human error, phishing attacks, and other things that are bound to happen in the course of normal business, especially with a newly remote workforce. These are threats you can mitigate and be prepared for, but they’re really never going to stop because humans will inevitably make mistakes.
Intentional Threats are more complex and trickier to spot.
According to the survey, 23% of the surveyed incidents were caused by malicious insiders. These threats come from disgruntled employees who are bad actors or who may be seeking revenge against the company for a perceived injustice. These are threats that every company must be vigilant about and have a plan in place to recognize and neutralize immediately.
Don’t refuse to consider the prospect of it happening to you.
Insider threats must be taken seriously as part of every cybersecurity plan. No matter how much your staff is “like a family”, humans are fallible. Never discount the possibility of disagreements that lead to disgruntled employees trying to damage the company or make extra money by selling data. Arm your staff to spot and eliminate insider threats efficiently.
Constant user behavior awareness and training are crucial to combating insider threats.
Training and awareness help your staff spot potential malicious actors and keeps them vigilant to threats like phishing attempts. Don’t press pause on training just because everyone’s working remotely – remote work increases the likelihood that staffers will get duped by a phishing attack. Mitigate the threat by employing training tools that use multiple forms of information delivery to get through to staffers in the way that they learn and can be used for remote workforce training easily. Plus make sure that the training material is frequently updated, like the COVID-19 threat training kits we recently added to our phishing training solution BullPhish ID.
Use remote access management and multifactor authentication to protect against malicious insiders.
Your IT staff need to be able to react immediately to mitigate potential damage by cutting off systems access as soon as a malicious insider threat is uncovered. Remote access management allows IT staff to quickly negate the stolen or compromised credentials prevent information theft that can come back to haunt you from the Dark Web and cut off access to systems that could be infected with ransomware. The one-two punch of secure remote access management enabling you to lock down systems and data anytime, anywhere and multifactor authentication to stops bad actors from getting mileage out of a malignant password provides powerful protection. Passly, our new secure identity and access management solution, combines multiple access safeguards including these into one cost-effective tool. Every company needs to have a plan in place to combat insider threats.
