Staff Are Still the Worst Threat to Security Stances

Do you know the worst threat to security stances? Cyberattacks continue to siphon billions per year off of legitimate growing markets, taking advantage of increasingly online workspaces and employee habits. While the overwhelming majority of focus – and budget – has been dedicated toward external network security threats, one potent attack vector has been under victims’ noses this whole time.

Read More: The Best Practices for Cloud Security: A Guide

Outside Threats Are Receiving All the Attention

The recent 2022 Cyber Security Insights Report found that, on average, cybersecurity budgets are set to increase 11% over the following two years. The previous two have seen cybercrime grow across the board, with all forms of attack undergoing substantial increase. Ransomware has established itself as a particular attack favorite, though certain industries have been hit harder than others. The overwhelming focus guiding most industries are external threat actors, with their arsenal of web app exploits and remote code execution.

Areas that are growing increasingly reliant on technology – such as education, healthcare, and research – have found themselves scrambling to protect against outside threats as they work through the early stages of winding up their tech stacks. Cyber attackers know that these areas offer fresh pickings. Organizations with established cyber protection are not off the hook, however: the greater the evolution of wider attack immunity, the further cyber attackers rise to meet this.

Machine learning and automation are two key ways that external threats continue to evolve. This year, cybersec expenditure will represent over a quarter of annual IT budgets, and a 5% YoY growth since 2021. This money is increasingly going toward evolving security technologies that aim to automatically patch and protect against code exploitation. Whilst undeniably important, this approach makes one key oversight.

The Overlooked Threat

Reports of remote code execution and cyberattackers remotely breaching corporate servers dominate the headlines; what doesn’t appear as often is the lurking concern of inside threats.

Despite the issue’s stage fright from public headlines, business executives continue to be deeply concerned around this form of weakness. In a recent study, 71% of business executives identified this as one of the highest threats facing their organization. This is almost identical to the number of execs concerned with outside malicious attackers. On top of this, over a fifth of those surveyed also stated concerns surrounding employees hiding malicious intent.

These concerns are well-placed: further research found that, while 20% of security incidents are contributed to by insider threats, the blast radius of insider attacks span much further than their purely external counterparts. Causing ten times the damage, organizations are rightly concerned with identifying and preventing a largely invisible threat. The scale of damage that a fully authorized user can wreak is largely down to the unsuitability of external-facing protection. No Web Application Firewall can stand in the way of a disgruntled employee. The risk thereof has skyrocketed over the last few years, as remote working and a difficult economy has facilitated the onboarding of disengaged and disenfranchised employees.

Of the three forms of malicious actors, the financially-driven is one of the most heavily researched. Attack group LAPSUS dipped their toes in this area in 2021, after they published a recruitment-style post offering money for active VPN logins within tech corporations. Another key motivator that plays a role in insider threats is spite. Spiteful threat actors can be almost impossible to spot before they strike, and react largely off internal affairs. Take the recent case of a New York Post employee tanking the company’s reputation by calling for the assassination of US President Joe Biden via their corporate Twitter. The final type of inside threat actor is the innocent but ill-informed: these get involved in threat activity without even knowing. This represents the largest chunk of inside threats, as employees are far more likely to mistakenly click malicious links than deliberately abuse internal access.

Knowing how to protect sensitive data from authorized employees represents one of the hardest cybersec challenges to date. However, a number of solutions offer wraparound protection for databases, allowing for tighter protection around highly sensitive data.

Read More: Skip Tracer For Remote Surveillance & Home Security

Protecting against insider threats

Most important to the protection against insider threats is a contextual awareness of the company’s own reputation. For instance, trigger events such as annual profit reports – especially during a cost of living crisis or recession – can tip some employees over to malicious acts. Assessing the level of animosity throughout an organization is vital to any cohesive attack monitoring process.

Anti-insider threat solutions take a data-first approach. One key security solution is automatic data analysis and identification. This allows for an organization to keep a close eye on all data within its control. A more granular approach is also supported; by automatically defining each data packet’s level of sensitivity, enterprise-wide policies can be created and maintained to monitor its movement throughout the enterprise. Agents installed at secure endpoints can lend full visibility onto the transfer of info between users and external parties. Endpoint-based technologies can block any exfiltration attempts – before data is used in a policy-violating way.

While endpoint protection monitors the use of such data, wider database monitoring allows for visibility into suspicious access patterns and commands. When suspicious user activity or data paths are detected, incidents are automatically provided with a risk score. This contextually looks at the sensitivity of data accessed, the privilege of the user’s account, and prevalence of such policy-violating behavior.

With these tools in place, it becomes possible to address insider risk with pinpoint accuracy, helping to drastically reduce response times.