Business still not addressing insider threat

Organisations typically overlook inside threats when considering cyber security risks, warns Carl Leonard, principal security analyst at Forcepoint.

“Many organisations are still neglecting the danger posed by the humans working inside those organisations, despite the fact this has been recognised as one of the root causes of data breaches for many years,” he told Computer Weekly.

There is nothing new in this, said Leonard, but despite that, many cyber security programmes still take a very narrow view of threats and do not address insider threats, failing as a consequence.

“Insider threats include a range of things from unintentional errors and compromised credentials all the way through malicious insiders intentionally taking data outside of the their organisation, which is all causing problems, but many organisations still have not got their head around that yet,” he said.

One of the main reasons for this, said Leonard, is that most organisations’ cyber defence strategies focus on external attackers and threats – especially malware – rather than the broader spectrum of risks they actually face.

“They are used to dealing with external attackers, malware, manipulated documents coming into their environment and dealing with security issues on endpoints, but have still got blinkers on when it comes to insider threats.

“As a result, we need a mindset shift to focus on the fact the machines and credentials that are being compromised by attackers belong to individual users,” he said.

By looking at what users are doing, Leonard said organisations are in a better position to identify anomalous or potentially risky activity.

“If a user starts to share data, organisations need to know about it so that they can look at intent to see if the user is transferring data to work from home or whether this behaviour is linked to malicious activity,” he said.

Getting visibility of user behaviour is the first important step, said Leonard, because it then enables organisations to establish control and take a broader view of cyber risk.

“Gaining greater control is important, particularly in the light of new data protection regulations, like the General Data Protection Regulation [GDPR], the fact that organisations are increasingly using cloud-based applications and services, and that a growing proportion of the workforce is working remotely,” he said.

Now that the GDPR compliance deadline has passed, Leonard said it has never been more important for organisations to ensure that any personally identifiable information (PII) is secure.

Leonard believes the GDPR will help drive a broader view of cyber risk in organisations because it will force them to review their security capabilities to ensure they have an appropriate level of security for protecting personal data.