Insider Threat Risks to Your Business
Managers are well aware of the threats posted by hackers and cybercriminals to their networks, and most are taking steps to secure their organisations and to ward off these outside threats. However, sometimes the biggest threat to your company comes from within the walls of your office.
Types of Insider Threats to Watch Out For
Certain employees often are involved in a range of scenarios:
Cases involving intellectual property theft, such as business plans or source code, often involve a former employee who worked on the project. Often, these culprits save company information on a USB drive and are never caught.
In cases of sabotage, highly technical employees, such as system administrators who become disgruntled after being fired, often set up an attack before leaving the company.
Fraud cases typically involve lower-level support employees, such as help desk personnel, who conspire with outsiders.
Potential Sources of Insider Threats
Companies that use file services like Dropbox and virtual machines should be careful, as employees can use these to exfiltrate information. One case of note involved a product development manager who had access to clients' trade secrets. He had access to information on two clients in the semiconductor industry and downloaded 80 documents before leaving the company and taking a job with one of these semiconductor clients. His new employer turned him over to authorities after learning about the breach, including the fact that 18 of the documents belonged to a close competitor. To protect your company from this type of threat, ensure that business partners protect information, audit their controls, and build it into contracts.
Another source of potential insider fraud is shared computers. Such as an instance at a university, where two students loaded malware onto publicly accessible computers so they could steal credentials and spy on student records.
In another situation at a hospital, a disgruntled security guard, who had a background in system administration, installed malware on systems. He was caught when he posted a video of his work, and another hacker reported him to the FBI.
Yet another instance involved a network engineer at a retail company who knew he was going to be fired. He created a VPN token for a fake employee before leaving the company, and then called the company's help desk pretending to be a new employee requesting a credential activation. After lying low for a few months, the former employee deleted corporate email accounts and virtual machines, creating a major headache for the company. To protect virtual machines, companies can scan memory files and tie virtual environments into existing security systems.
Insider Threat Warning Signs
While these examples of rogue employees wreaking havoc on companies might be scary, they serve as a reminder that threats need not come from outside a business.
In a recent Tech Republic article, writer Tom Olzak shares a list of possible signs that an employee is about to go rogue, possibly creating a security risk for your company. His list includes the following:
- Attempts to circumvent security controls
- Unexplained, repeated absences on Monday or Friday
- Pattern of disregard for rule
- Long-term anger about being passed over for a promotion
- Pattern of lying and deception of peers or managers
- Frustration with management for not listening to what the employee considers grave concerns about security or business processes
Watch out for these signs that someone may become a threat, and communicate with that employee immediately to attempt to remedy the situation before it spirals out of control. Since employees often hide malicious behaviors from managers, training all employees to watch out for signs of discontent can help with prevention. Providing a way for employees to anonymously report peers can help them look out for your company without fear of being labeled a tattletale.
About the Author
Geoff Stewart is a highly experienced and skilled Technology Director at Surety IT. His knowledge is based on years of industry experience having created customised, stable, well performing systems both for multi-national companies in the UK and Australia and Surety IT customers.
Surety IT can help you create the right system to enhance your business, ensuring you know how it is right for you and how to use it. We will tailor a solution to suit your needs with leading systems, local support and more, building your vision for a more flexible and capable business.