Attacks originating from within an organization are becoming much too common, and these attacks are costing companies far too much. A recent study found that fifty percent of organizations have faced an insider attack in the last twelve months.
Not all insider threats are of malicious intent. Sometimes an insider threat can come from accidentally leaked information. Or, in contrast, someone may pose as an employee to gain access to sensitive information that will ultimately cost your organization financially, reputationally, and peace of mind.
The Ponemon Institute found that the average cost of an insider attack is upwards of $600,000.
But when insider threats are of malicious intent, there is a general profile to look out for. A study done by the Centre for the Protection of National Infrastructure has resulted in this profile of the perpetrator:
- More likely to be committed by men
- Ages 31-45
- Usually committed by permanent staff rather than contractors
- Most insider attacks were committed by employees who had been at the company for less than five years
Although not all attackers will meet this general profile described above, it’s probably a good idea to keep an eye out. The next essential thing that should be addressed is… why do insiders attack their own? This can get complicated, but the overall theme is for financial gain. This can take the form of a criminal offering an insider money in exchange for specific information or the insider offering information for money. In other circumstances an insider attack can also be in the form of retaliation or for career benefit. A soon-to-be ex-employee might take client lists or intellectual property belonging to the organization, so they are in an advantaged position at their new job at the expense of their old company.
With a little better understanding of what an attack may look like, it’s now essential to look at how you may be enabling insiders to attack your organization. Most of the time, insider attacks come from a lenient access to information within the organization. It’s important to take a look at who has access to sensitive information like client lists, financials, employee W-2s, etc. Make sure that only necessary people have access to things like that. Next, look at your “Bring Your Own Device” policies. Allowing employees to bring their own devices may allow unwanted persons to have access to your firm’s sensitive information.
Overall, it’s best to create policies that limit the potential for a malicious insider to steal or to share information, which of course would be detrimental to your organization. Implement those policies regardless of how much you trust and rely on your employees.
LibertyID is the leader in identity theft restoration, having restored the identities of tens of thousands of individuals without fail. If you retain personal information on your customers, now it is time to get data breach planning and a response program in place with our LibertyID for Small Business data breach defense program. With LibertyID Enterprise you can now add value to existing products, services, or relationships by covering your customers, employees, or members with LibertyID’s fully managed identity theft restoration service—at a fraction of our retail price—with no enrollment and no file sharing. We have no direct communication with your group members–until they need us.
Call us now for a no obligation proposal at 844-411-LIBERTY (844-411-5423).