Cybersecurity professionals spend much of our time focusing on keeping threats out — and with good reason. From business email compromise attacks (BEC) to malware, there are a host of threats that, once inside our defences, can do significant damage. However, not all attacks are perpetrated by outside forces. Sometimes, the threats are coming from inside the organisation.
Just like outside threats, those that stem from the inside have the potential to cause significant damage.
Not all insider threats are malicious, however. When we consider unintentional threats – such as the installation of unauthorised applications or the use of weak or reused passwords – this figure is likely much higher.
Whether due to human error or malicious intent, threats from within are notoriously difficult to defend against. Not only is the attacker already within your defences, but in the case of malicious insiders, they may be able to use privileged access and information to actively avoid detection.
Understanding insider threats
When constructing a defence against insider threats, it’s easy to make the case for the old cybersecurity adage: trust no one.
However, this approach is not practical nor conducive to the flow of information required to run a modern-day business.
Fortunately, there are several less drastic steps that can be taken to detect insider threats – or better still, to stop them before they take root.
The first step is to understand exactly what drives an insider to pose a threat to your organisation. Motivating factors can generally be grouped into three categories:
- Unintentional: From installing unauthorised applications to misplacing equipment or reusing passwords, careless employees can pose a serious threat to your organisation.
- Emotionally motivated: Threats of this nature are posed by employees with a personal vendetta against your organisation. Emotionally motivated malicious insiders may seek to cause damage to your reputation by leaking privileged information or disrupting internal systems for maximum inconvenience.
- Financially motivated: There are many ways to profit from privileged access, be it through the leaking of sensitive data, selling access to internal networks or disrupting internal systems in an attempt to affect company share price.
Whatever the intent behind them, insider threats can occur at any level of your organisation. With that said, actions that take place lower down the business hierarchy may be harder to detect.
Source: techwireasia
