The Insider Threat

Introduction

The threat to a business from the outside is well-known and even expected, but sometimes the threat comes from within. Management doesn’t want to think about it, but the insider threat is very real.

As managers, we have to ask ourselves, “why would an employee intentionally hurt the very company that pays them?  The reasons vary, of course, but there are a few that come to mind:

• Baling out – stealing information to take to another job
• Plain old Greed – selling data to the competition for money
• Super-greed – working with cybercriminals to share in a huge payday

Here’s the issue—human behavior can’t be easily predicted, and a business needs to take the approach of training their workforce to fend off cyberattacks and installing internal controls to mitigate inside threats.

Have you ever read a questionnaire from an insurance company for cyber-insurance? Notice how they seem to dwell on internal controls. Unfortunately, many companies have been seriously harmed by malicious employees.

Offsetting the Risk

Establishing accountability will lessen the risk of internal dangers. Some behaviors should trigger alarms:

• An unusual number of files being accessed and opened
• Avoiding or trying to work around established security measures
• Saving files to unusual locations
• Utilizing USB drives to save or move information
• Using tools or software that hides online activity
• Installing unknown and unapproved software onto their computer
• Becoming defensive when asked questions about their work activity

This is why strong internal controls are a must for all companies. Network activity must be watched for unusual behavior and immediately investigated when found. Companies that do not have the resources internally should use a Managed IT Services Provider (MSP) specializing in security.

It’s A Two-Front War

Businesses are battling criminals on two fronts—outside threats and threats from within. While inside threats are not pleasant to think about, they’re real and must be anticipated. This is where security systems shine and can save your business.

A good MSP will employ all of the latest protective tools, such as Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM), Security Awareness Training for your employees, and a Security Operations Center (SOC). They’ll keep watch over your network and take immediate steps when unusual activity is detected.

Conclusion

The days are gone when the only thing a business needs is a good antivirus program. Cybercrime has advanced far above that. Small-to-Medium size businesses (SMBs) need much more to protect themselves.

Managed IT Security is not as expensive as you may think. Look into it now! Be safe.

XSolutions is an IT Services Provider serving New York (NY), New Jersey (NJ), and Connecticut (CT). We provide Managed IT Services | Managed IT Security | Backup & Disaster Recovery| Cloud Data Protection. Call (845) 362-9675 for a free consultation.