By Hermann Hesse, vice president of solutions, strongDM
As organizations continue the fight to keep outside adversaries from penetrating networks, it’s also become critical for security teams to make sure employees, partners and contractors are also not threatening the enterprise.
An insider data breach costs companies an average of $15.38 million and takes 85 days to contain. That combined with reputational damage and loss of trust has catapulted the topic of the insider threat to the top of many CISOs’ minds.
In this piece, I’ll take a look at insider threats in cybersecurity and the dangers they pose. By the end, you’ll have a clearer understanding of the entire insider threat ecosystem and the best practices you can use to protect your organization, data, and systems.
What is an Insider Threat?
An insider threat occurs when a person with authorized access—such as an employee, contractor, or business partner—compromises an organization’s data security.
A History of Insider Threats
Insider threats have existed throughout history—in religions, ideological groups, government and financial institutions and more. Those with special knowledge or access to ideas, information, money and even other people often used their advantageous positions to block opposition or to gain power, money and influence for themselves. Espionage is a classic example of an insider threat.
Over time, the nature of insider threats has evolved and expanded. In today’s digital age, insider threats frequently involve a cyberattack or IT incident. These security incidents occur across industries and institutions of all sizes and are growing more prevalent as organizations shift to a remote work approach. In fact, 75% of insider threat criminal prosecutions in 2021 were the result of remote workers.
The Three Types of Insider Threats
There are three categories of insider threats: intentional, accidental and compromised.
An intentional threat is caused by a malicious insider—someone who aims to cause harm to or negatively impact the organization. Typically, malicious insiders are motivated by financial, emotional or political gain. Examples include a recently terminated employee who is aiming to get revenge for being fired or someone who is being financially persuaded by a competitor.
An unintentional insider threat occurs when someone accidentally causes harm to an organization or exposes it to future risk. Common examples are employees or contractors who haven’t been given adequate security training, don’t know how to use a piece of technology correctly or simply make an honest mistake by sending an email to the wrong person.
A compromised insider threat incident is when a legitimate user’s credentials have been harvested by a threat actor. In this circumstance, the adversary is able to gain unrestricted access while remaining under the guise of an employee or partner. One example of this is when an employee falls victim to a phishing attack where a hacker is able to lure the login and then use it to exfiltrate sensitive documents.
The Danger and Risks
Today’s businesses are so reliant on I.T. and systems to operate that any threat—whether malicious or not—opens up your organization to major financial, compliance and legal fallout.
Data breaches can expose a trove of sensitive and confidential information about your company and customers, seriously hurting your organization’s trust and credibility. Once trust is lost, customers take their business elsewhere, leading to lost revenue. If a law or regulation was violated during the data breach or its containment, your organization could face fines, penalties and lawsuits.
Who Is at Risk?
Any organization can fall prey to insider threats, especially if it deals with sensitive data. But while small and large organizations alike can both experience threats, the nature of the insider threat risk is different for each.
Small organizations tend to have fewer IT resources and smaller budgets, which limits how much they can devote to insider threat user activity monitoring and securing networks, infrastructure, and personnel. On the other hand, large organizations have a larger attack surface—with hundreds if not thousands of employees spread out across multiple locations.
Protecting Against Insider Threats
Now that you have a better understanding of what an insider threat is, its important to also know how to protect against them.
One of the easiest ways to protect against insider threats is never putting credentials in the hands of an insider in the first place. Security teams can do this by using a centralized access management platform so that users can only sign onto a single workspace to access all the applications or tools they need. Centralized access management platforms enable authentication, authorization, networking and observability to help protect organizations against insider threats. Security teams get centralized access to user accounts while automated access workflows eliminate time-consuming manual tasks. Role- and attribute-based access control restricts network access to authorized users, and the system’s auditing capabilities provide a clear audit trail of privileged session activities.
The Bottom Line
Insider threats can come from anywhere, no matter the size or makeup of your organization. By having a clear understanding of the history of insider threats, how they might appear and using a centralized access management platform, security teams can stay one step ahead.
