The number of insider threats from employees causing IT security breaches has skyrocketed since 2007. Globally, over 4.2 billion records were compromised in 2016, and according to Verizon’s 2015 Data Breach Investigations Report, 50% of all security events were caused by employees from inside the organization where they work. It’s no longer a matter of “if” your business will be hit, but “when”.

Insider threats by staff or contractors causing IT security breaches  – whether malicious or accidental – are one of the largest sources of cyber-attacks to a company.

Not all of these attacks are brought on with malicious intent. 30% of the above 50% were from employee negligence such as sending information to the wrong person or not disposing of sensitive information properly. Some employees may not understand the possible risks of their actions. With effective IT security training for your employees, the number of insider threats causing security breaches can be halved.

Often however it is because of a “rogue” employee who was granted access to sensitive documents and upon feeling slighted at work for whatever reason, decided to expose such information for personal gain.

In fact, many in the IT profession now fear disloyal employees pose a greater threat to companies’ IT security than outside hackers.

The thought of employees leaving a company with confidential data is a major concern as external criminals are actively pursuing insiders to help infiltrate networks, while at the same time more and more disgruntled employees are making their insider access available.

Before we look at solutions, it’s important to understand the different ways employees and contractors can be responsible for such it security breaches.

Negligent Employees
This involves staff that use weak passwords, visit insecure websites and open suspicious attachments and links. It can also be attributed to employees who lose company devices or allow others to use company mobile devices.

Disgruntled Employees
Disgruntled employees, especially those working in the medical and financial sectors, are being actively recruited by criminals on the Dark Web to sell their access codes to company networks and other sensitive data. The Identity Theft Resource Group (ITRG) said the motivating factor for these rogue employees is often greed. Eva Velasquez, CEO and president of the ITRG has stated that many of the individuals that have access to sensitive information are working for minimum wage and may feel bitter because they cannot support themselves.

BYOD (Bring Your Own Device)
Passwords are often weaker on personal devices, opening the door for hackers. If an organization’s confidential information is copied onto a personal device, the risk of theft increases. A recent survey found that two-thirds of businesses globally have experienced an IT security data breach into their network from employees’ mobile devices.

Unauthorized Devices on the Network
While inserting a USB stick into a company computer may be necessary, it’s important for portable devices to be scanned and monitored before ever plugging into the company network. This will help to avoid hackers gaining access and malware being downloaded.

Third-party Contractors
Granted, third-party service providers are a vital component to many business operations, but problems can arise if their security is not as strict as your company’s. If a contractor uses one password for all of their employees per client account, this can create insider threats because it won’t take long for a hacker to guess the password. A surprisingly large number of data breaches have been attributed to remote third-party access channels.

For more information on what to do to prevent insider threats from occurring, read the second part of this blog “7 steps to reduce insider threats.”

Business Information Solutions, Inc. (BIS) offers proactive IT security and managed services in Mobile County and Baldwin County, Alabama, as well as in Pensacola and Gulfport, MS. Our services include thoroughly monitoring your network 24/7 including desktop, email and mobile device protection through our BIS Firewall Security Management and anti-virus and spyware solutions. All along the Gulf Coast, our goal is to grow your business as your technology partner, reducing the risks of any insider threats, through a long term relationship built on trust.
[code-snippet name=”disable-blog-featured-image”]