How to Mitigate Insider Threats

When imagining a cyber-attack, most would imagine an external hacker locating a vulnerability in a server and installing malware. However, the world of cybersecurity is much more nuanced and complicated. The people inside an organization can also act as a vulnerable entity; our people and the broader supply chain can unwittingly become an 'insider threat.' Malicious insiders also exist and can be one of the most challenging cybersecurity menaces to detect. According to IBM, the result of insider threats is a cost to businesses of around $11.5 billion a year.

TitanHQ explores what an insider threat is and how to mitigate the impact of both malicious and accidental insiders.

Who is Behind an Insider Threat?

Insiders can be anyone who works directly or indirectly for an organization. This covers many people, from current and former employees to contractors, freelancers, and suppliers. As well as having lots of people who can potentially act as an insider, the types of threats come in many forms; some examples demonstrate how insider threats can cause data leaks, malware infection, and facilitate scams:

The Accidental Insider

Accidents happen constantly, but when the accident involves technology, it can result in leaked data and other IT resource damage. Accidental insider events often begin with a phishing email, the insider clicking a malicious link that takes them to a spoof website. An example of an unintentional insider event was the successful spear phishing campaign against Twitter (X) employees. The persistent hackers eventually located and socially engineered employees to gain access to systems that led to 130 Twitter accounts being compromised.

The Negligent Insider 

Negligent insiders may cause a data breach by simply mistyping an email address or cc'ing unauthorized people. Email misdelivery, i.e., sending an email to the wrong recipient, was found to be a consistent problem in healthcare and the financial services sector by Verizon. An example was a recent login credential exposure involving several Microsoft employees. Microsoft confirmed the breach and told Vice magazine, "We continue to see that accidental source code and credential leakages are part of the attack surface of a company, and it's becoming more and more difficult to identify in a timely and accurate manner. This is a very challenging issue for most companies these days."

The Malicious Insider

The motivations behind the malicious insider may involve financial compensation or grudges against the company or other employees. Also, dark web operatives are known to recruit malicious insiders to carry out surveillance or provide access to systems. Poaching by a competitor is another issue that creates malicious insider risk. This latter driver was behind a 2022 Apple lawsuit against rival Rivos. Apple claims that the company poached Apple employees, including a claim that some of the poached engineers stole large amounts of proprietary information.

The Outcome and Impact of Insider Threats

An insider incident can be as, if not more, harmful than an external security attack. Insider threats lead to various outcomes, including ransomware infection, data loss, Business Email Compromise (BEC) scams, malware infection, and non-compliance with data protection regulations. The cost of the impact caused by an insider threat depends on the type of insider: research by the Ponemon Institute found that the annualized cost for insider threats was: 

• Negligent insiders - $6.6 Million 
• Malicious insiders - $4.1 million
• Accidental insiders (credential theft) - $4.6 million

The report also found that it took, on average, 85 days to contain an insider-related security incident. The answer to insider threats is not simple; there is no one-stop shop to detect and prevent insider incidents. Instead, various tools and measures are used to stop this insidious threat to an organization. 

The result of insider threats is a cost to businesses of around $11.5 billion a year.

IBM

Steps to Mitigate Insider Threats

The following steps are recommended as a holistic insider threat detection and prevention approach.

Know Your Risk

Understanding the risk areas where insider threats can impact is an essential first step in developing subsequent programs to control the threat. Terminations and reprimands may increase the risk of a malicious insider event. Having a risk register of such events and putting procedures in place to manage processes is essential. For example, create a policy and procedure to handle the prompt offboarding of users from your identity management system.

Security Awareness Training

Behavior-led security training packages, like SafeTitan, are a fundamental first step in addressing the behaviors that cause negligent and accidental insider threats. Security awareness training must offer a comprehensive set of training materials and measures to stop all the potential areas where people make mistakes or inadvertently get caught up in a cybercriminals' social engineering attempt. Security awareness training can help to educate employees about their role in keeping data and other resources secure, including in the following areas:

Password Hygiene: A 2022 study found that 62% of employees share passwords via text or email. Sharing passwords and poor general care around password creation and use can result in unauthorized access and data leaks. Security awareness training provides educational content to teach employees about the importance of passwords.

Phishing: Phishing simulation software allows companies to create spoof phishing campaigns to train employees to detect phishing emails. The simulators also provide interactive training to encourage good security behavior.

General Security in the Office: A 2022 Quocirca Print Security Landscape report found that 68% of companies lost data because of print-related negligence, such as leaving sensitive documents on a printer. Security awareness training provides interactive and engaging sessions to teach employees about general security issues and how carelessness can lead to exposed data.

Web and Mobile Security: Security awareness provides training on navigating the internet and using mobile phones safely.

Set Up Privileged Access Rights

Another fundamental area of control to prevent insider threats is to ensure that the principle of least privilege is adhered to. Only authorize those who need access to resources. Ensure that permissions populate and are enforced across the network and all edge devices, including remote.

Monitor and Alert

Malicious insiders can be challenging to detect as they misuse legitimate credentials. Risky behaviors should be monitored. This can be done by in-person line managers or tools that use machine learning threat detection.

Email Security and DLP

Email security, anti-phishing gateways, and data loss prevention (DLP) should be deployed as another layer that works with security awareness training. Email security gateways will work to stop phishing emails from entering an employee's email inbox. DLP solutions will stop sensitive or proprietary information from leaving your corporate network. These security solutions act holistically to prevent accidental and malicious insiders.

Read more on email security on TitanHQ's blog.

How SafeTitan Helps to Stop Insider Threats

SafeTitan is a behavior-driven security awareness training solution and builds an organization-wide security culture that empowers employees with effective security habits. This solution delivers robust anti-insider threat prevention through education. Some of the features of SafeTitan that prevent accidental and negligent insiders are:

• Gamified Training: Engaging and fun content based on short and efficient testing. Sessions cover all aspects of IT security, including password hygiene. 
• Contextual Learning: Interventional feedback gives employees the information needed to understand the impact of their actions.
• Simulated Phishing: SafeTitan's simulated phishing platform has been shown to reduce staff susceptibility to phishing by up to 92%. The cloud-based platform is highly configurable and granular and provides thousands of phishing templates to create realistic and practical spoof phishing sessions.
• Risk and Compliance Reporting: Generates reports demonstrating compliance with data security and privacy regulations.
• Exceptional Support: SafeTitan can be delivered by either an MSP or directly, with TitanHQ's outstanding support.

Insider threats are challenging, but tools and measures such as SafeTitan can mitigate the risk and prevent cyber-attacks. Sign up for a free SafeTitan demo.