By Sonit Jain, CEO of GajShield Infotech
As the name suggests, organisational insider threats are the cybersecurity hazards caused, intentionally or unintentionally, by persons (employees, business partners or other internal stakeholders) related to an organisation. There can be several reasons for internal stakeholders to turn into threats for an organisation: Using company data for fraudulent financial gains, employees being disillusioned with existing policies or managers, workers unintentionally leaking out confidential data, negligence on the part of employees while working, amongst other reasons.
Normally, insider attacks on a company’s data security can be carried out by three categories of individuals:
a) Malicious users:
These are the persons who know what they are doing when they compromise their organisation’s network security from within. There are several reasons for internal stakeholders to cause harm to their employer/business partner. Malicious users take undue advantage of their user access to the company’s databases or other systems. Insider attacks by such individuals can be in the form of the wilful extraction of sensitive and confidential IP information. More importantly, such individuals can be hard to track down as they can perform these actions stealthily and without leaving behind ‘footprints in the sand’.
b) Infiltrators:
Some insider attacks take place because certain employees unknowingly become access points for external malicious entities to wreak havoc in the organisation’s data networks. Such compromised individuals generally do not know that they have been targeted. Cybercriminals use social engineering techniques like phishing and malvertising to dupe naive employees. Usually, this is the most common type of insider attack in organisations.
c) Negligent insiders:
Negligent insiders are worth their weight in gold for cybercriminals looking to digitally harm organisations. Careless insiders represent the easiest gateway for hackers to get into an organisation’s data networks. Although data security training is fairly common for employees in most organisations, not everybody is guaranteed to diligently follow the basic safety measures consistently at all times. Cybercriminals or internal malicious elements can access devices or network terminals left unlocked (even for a few minutes) before executing their sinister plans. Revealing confidential user IDs and passwords to colleagues or outsiders is a common mistake that careless insiders make.
WAYS TO DETECT AND PREVENT INSIDER ATTACKS
a) Screening fresh (and potential) recruits
As they say, insider attacks can be detected early and nipped in the bud if an employer is vigilant during a recruitment phase. Human resource executives in organisations must conduct extensive background checks for potential recruits during the hiring process. Speaking with a candidate’s former employers can also be useful to assess their past behavioural and integrity records.
b) Conducting regular cyber-safety training
Periodical data security training is essential for organisations to prevent negligent employees from indirectly causing insider attacks. In such training sessions, employees are taught about how threats such as malware and phishing attacks work. Additionally, internal stakeholders are made aware of remote cybersecurity risks, potentially malicious websites, and links. Organisations can cover lesser-known topics such as shadow IT hazards and cyberattacks caused via emails and text messages. Data experts can observe which employees follow the regulations and measures specified in the sessions to catch malicious users over a longer period of time.
c) Tracking employee behaviour
While employees may be unhappy about being assessed continuously, insider cyber threats cannot be detected without constant monitoring. As a reference point, organisations can establish behaviours that can be classified as ‘acceptable’. These behaviours may include normal working hours, websites visited, types of downloads made, amongst others. Once these parameters are clearly defined, organisations can actively lookout for behavioural abnormalities like:
- Installing applications and files unrelated to work operations.
- Signing into the organisation’s networks at odd hours.
- Creating multiple unauthorised users accounts for logging in.
- Copying sensitive information onto a notepad or their system dashboard.
There are several ways to effectively implement employee monitoring measures in the workplace. Once the network administrators find any such activities, they can take the necessary measures to prevent or mitigate probable insider attacks.
d) Improving IAM systems for better data security
Regulating user access is one of the first things organisations must do to detect or prevent insider attacks. Organisations have their data stored in multiple locations, such as standard network databases and cloud storage facilities. By tightening their access controls with context-aware data security systems (like intelligent firewalls and advanced Multi-Factor Authentication systems), organisations can regulate access controls for users who are trying to log in to their data reservoirs. Additionally, by controlling these things, data managers can prevent the loss of information from company databases.
e) Deploying a security team
Organisations must hire a team of experts who will establish solid data security protocols in the organisation. The team’s primary responsibilities include preventing suspicious individuals from being in close proximity to important IT devices, switches, control panels and server rooms. The experts can also lend a hand in the frisking operations of individuals entering or leaving the workplace to detect any piece of hardware they may be possessing. Such teams are generally responsible for creating strict protocols for data security in organisations. They constantly monitor insider behavioural patterns to learn if any digital threat is around the corner. Normally, physical security teams ask individuals to switch off their cell phones when they are in their workstations. Simple actions, such as physically securing the server rooms, are carried out by these individuals.
f) Discarding used hardware and digital documents efficiently
Organisations must discard digital databases after ensuring that the data within them is deleted completely (even from the trash folders). By doing this, the deleted data becomes completely unrecoverable. Physical storage devices must be destroyed once they are no longer in use. Individuals from an assigned IT team can carry out these tasks.
