Hackers, cybercriminals, and nation-states all present real, measurable risks to your systems and data. But the leading cyber threat continues to be insider threats. According to numerous studies, people on the inside of an organization or government agency are the source of the greatest risks. By some accounts, insider threats can cost an organization millions of dollars. Plus, it can take months to contain the impact of an insider breach, if you detect it at all.
Greatest among these threats are careless or non-malicious insiders; that is, those who inadvertently allow access to secure systems and data. In fact, industry surveys show that the majority of security breaches stem from carelessness on the part of employees or contractors. Seemingly harmless actions— something as simple as clicking on a link in an email or leaving a screen open on a desktop before heading out to lunch—can allow bad actors access to the network.
Additionally, contractors should be limited in what systems they can access, but if those systems have a way to connect to others across the network, your security could be compromised. Over the past few years, a number of high-profile breaches were traced to contractors having access to seemingly innocuous systems, such as HVAC controls, that tied into the enterprise network.
Naturally, agencies are on heightened alert for malicious insiders – disgruntled employees or those working with criminals or foreign entities to compromise or steal data. With intellectual property, state secrets, and the personal information of all U.S. citizens on the line, identifying and blocking cyber assaults is critical, but made harder when insiders are involved, either by choice or unwittingly.
In a webinar coming up on May 2, 2019, Matt Shelton, Director of Technology Risk and Threat Intelligence at FireEye, will take a deep dive into the risks posed by insider threats, including which systems may be most at risk. He’ll also discuss how to identify a threat from the inside as well as practical steps you can take today to secure your organization’s systems and data.
The insider threat to government systems is growing rapidly. While agencies have made a lot of progress in fighting cyber threats, the battle lines keep shifting. More education is needed to engage employees in becoming more vigilant. At the same time, the right technology can help, if it’s applied appropriately. The critical thing for CISOs and employees throughout an organization is to commit to taking action.
