Preparation and prevention vs insider threats

Insider threats may have been looming even before the start of the Covid-19 pandemic, but the crisis further put a corporation’s security in distress.

Because of the drastic changes caused by the pandemic, the various factors that could motivate employees and other insiders to put their organization’s computer network in danger intensified. These include fear, anxiety, anger, depression and financial troubles.

Working remotely also cultivated an environment that offers malicious insiders opportunities to execute security breaches. And employee negligence can result in the unauthorized access to or sharing of information from laptops, mobile phones, cloud storage and other technologies.

Organizations must increase their vigilance and diligence to reduce insider threats during this time. These can be done by applying a proactive approach in balancing security and privacy.

The rise of insider threats

The dramatic increase in security breaches requires organizations to take a more comprehensive approach in combating insider threats. A study by the Ponemon Institute, a leading security research organization, showed that insider threats have jumped by 47 percent over the past two years. Reasons cited for this increase include the growing number of emboldened insiders who are determined to commit theft, fraud and espionage; negligent employees who unintentionally made disclosures by using weak passwords or divulging sensitive information by falling prey to phishing; and using compromised devices for work. These have been especially amplified by the work-from-home arrangements that many firms have adopted.

As the term indicates, insider threats are mostly caused by complacent employees, contractors and third parties, rather than malicious external threats. To provide some perspective, 62 percent of insider-threat incidents are caused by negligent, hasty or unaware employees; 23 percent resulted from compromise, with stolen and sold insider credentials leading to identify theft and sabotage; and 14 percent are linked to insiders with intent to commit theft, fraud or espionage.

Insider threats are aided by different tools, such as encryption, cryptocurrencies and dark web trading sites, and working remotely can significantly contribute to them.

Furthermore, when information is stored in the cloud, it can be accessed anywhere, thus making it easier for hackers to steal it. Understanding the signs that indicate insider threats can help organizations trace potential issues and prevent breaches from happening.

As digital transformation is currently trending, the internet has made it easy for cyberattackers to steal private data from organizations. Platforms such as dark websites and the onion router allow buyers and sellers to trade data online. Cybercriminals are exerting great effort to search for vulnerable insiders who are willing to give them the data they need while looking for ways to hack systems.

Human error

While we know that human behavior is the ultimate cause of insider threats, most organizations still rely on technology to detect and prevent attacks. This approach has led to organizations only reacting after an attack has occurred.

It is suggested that an organization must have a human-centric insider threat program from the beginning. Employees should be engaged through training, transparency and communication. The program must also make use of human behavior and analytics tools to determine possible human vulnerabilities and prevent a potential breach. Employee involvement should be a big part of any organization’s cybersecurity program.

Engaging employees to identify and help prevent insider threats makes them an organization’s top ally in cybersecurity. By using technology and analytics to identify and predict potential human vulnerabilities, an organization would have a more robust insider-threat program. But with all these said, it would still need to balance employee participation and behavior. This makes training, awareness, communication and assessment of privacy risk very important.

Implementing insider-threat programs

Insider threats have been established as notable cybersecurity risks that can result in heavy financial and reputational damages. To ensure consistency and compliance, organizations must carefully design insider-threat programs to cater to long-term use and sustainability.

According to Grant Thornton, the effective implementation of this program is marked by three pillars: Assess, Build and Run. Assess makes sure organizations evaluate regulatory requirements, industry standards and best practices that apply to high-value data. This includes evaluating data protection tools, solutions, risks and employee preparedness.

Under Build, organizations should implement the changes identified during Assess, and must make up of policies, procedures, governance, teams, training and tools. They must also implement and integrate technology to identify and track insider-threat indicators.

Under Run, effective programs should be managed and monitored. Among those factors monitored are employee sentiment, awareness, compliance and training, and reporting on performance and risk metrics. Programs must also be adjusted based on feedback and regular independent audits.

Overcoming the challenges of remote working

Of course, there will be challenges in implementing an insider-threat program amid the pandemic, given that many employees still work from home. Trying to maintain a secure online work environment is already difficult, and introducing such a program may even be more so. But one must remember that with employees working remotely using laptops, mobile devices and independent internet connections, the risk of security breaches increases.

As dated cybersecurity methods involving traditional firewalls are becoming obsolete, it becomes necessary for organizations to take the initiative in addressing insider threats where the line between trust and human behaviors are ever changing. Investing in cybersecurity at this time will reap great benefits as cybercriminals are still looking out for vulnerable links. Prioritizing cybersecurity is undoubtedly one of the decisions that would make or break any organization’s future.

Mark Bajar is the lead consultant of the Advisory Services Division of P&A Grant Thornton. P&A Grant Thornton is one of the leading audit, tax, advisory, and outsourcing firms in the Philippines with 22 partners and more than 900 staff members. We’d like to hear from you! Tweet us with @GrantThorntonPH; like us on Facebook at P&A Grant Thornton; and email your comments to pagrantthornton@ph.gt.com. For more information, visit www.grantthornton.com.ph.

As published in The Manila Times, dated 17 February 2021