The pandemic and its aftermath have seen a seismic change in IT, particularly in Cyber Security. Remote access to systems and data brought about by working from home and e-commerce has increased significantly. We have seen an increase in general network-based exploits such as ransomware, the distribution of malware by email and social media, and attempts to collect personal information through spam e-mail and social media.
Cyber Security tools and techniques to protect against external attacks are well documented and available, but one area that has not received as much attention is guarding against insider threats. Statistics show that many attacks start with trusted users, commonly called insiders.
What is an Insider?
An insider, in the context of Cyber Security and information security, is a person who has authorised access to an organisation’s systems, facilities, or sensitive information due to their status as an employee, contractor, or business partner. Insiders are individuals who have some level of trust within the organisation, as they have been granted legitimate access to internal resources.
Insiders can be classified into two main categories:
-
Malicious Insiders: These are individuals who intentionally abuse their authorised access for personal gain, to harm the organisation, or to leak sensitive information. Malicious insiders may have various motivations, such as financial gain, revenge, ideological reasons, or other personal reasons.
-
Accidental Insiders: These are individuals who unintentionally cause security breaches or incidents by making mistakes or errors while using the organisation’s resources. Accidental insiders may click on phishing emails, mishandle sensitive data, or inadvertently expose critical information.
What can be done about Insiders?
Mitigating insider attacks is crucial for protecting your organisation’s sensitive information and assets. While it is impossible to eliminate the risk, there are several measures you can take to minimise the likelihood and impact of insider threats. Here are some best practices to help you mitigate against insider attacks:
-
Security Policies and Procedures: Establish clear and comprehensive security policies that outline acceptable use of resources, access controls, and data handling guidelines. Ensure that all employees and contractors are aware of these policies and regularly train them on security awareness.
-
Background Checks and Screening: Conduct thorough background checks and screening processes for all new employees, contractors, and third-party vendors who will have access to sensitive information or critical systems.
-
Least Privilege Principle: Implement the principle of least privilege, where employees are only given the minimum level of access necessary to perform their job duties. Regularly review and update access permissions based on job roles and responsibilities.
-
Access Controls and Monitoring: Implement robust access controls, including multi-factor authentication (MFA), to prevent unauthorised access. Regularly monitor and audit user activities to detect suspicious behaviour.
-
Separation of Duties: Avoid giving a single employee excessive control over critical systems or processes. Divide tasks among different employees to prevent any individual from having too much power.
-
Secure System Configuration: Ensure that all systems, applications, and databases are properly configured with the latest security updates and patches. Restrict access to cloud-based and removable (USB) storage. This will help prevent vulnerabilities that could be exploited by insiders or external attackers.
-
Data Loss Prevention (DLP): Implement DLP solutions to monitor and prevent the unauthorised transfer or disclosure of sensitive data. These tools can help identify and block data exfiltration attempts.
-
Employee Training and Awareness: Regularly conduct security training and awareness programs to educate employees about the risks of insider threats and how to identify and report suspicious activities.
-
Incident Response Plan: Develop a comprehensive incident response plan that includes specific procedures for responding to insider threats. Ensure all relevant stakeholders are aware of their roles and responsibilities during a security incident.
-
Support Whistle-blowers: Set up a confidential reporting mechanism, such as a hotline or secure email, to allow employees to report potential insider threats without fear of retribution.
-
Monitoring External Communications: Monitor and review external communications, especially those involving sensitive information, to identify any potential indicators of insider threats.
-
Regular Reviews and Audits: Conduct regular security reviews and audits to assess the effectiveness of your security measures and identify areas for improvement.
-
Cultural Awareness: Foster a positive and transparent organisational culture where employees feel valued and supported. Address any grievances promptly to prevent disgruntled employees from becoming potential insider threats.
-
Encryption and Data Protection: Encrypt sensitive data both at rest and in transit to protect it from unauthorised access, even in the event of a breach.
-
Vendor and Third-Party Risk Management: Ensure that third-party vendors and contractors adhere to your security standards and have appropriate security measures in place.
By implementing these measures, you can significantly reduce the risk of insider attacks and improve your organisation’s overall security posture. However, it’s important to remember that no security strategy is foolproof, and continuous monitoring and improvement are necessary to stay ahead of evolving threats.