Mitigating Insider Threats: Your Worst Cyber Threats Could be Coming from Inside

Ransomware attacks and major data breaches from external threat actors often grab the headlines, but organizations must continue to look inward for cyber incidents that can deliver some of the worst financial consequences. Consider that these incidents often arise through those entrusted with access to and within the organization itself.

Insider threats, both inadvertent and malicious, have risen 44 percent over the last two years, with costs per incident up more than one-third to $15.5 million globally. An average of $184,548 is spent to contain insider threats, with business interruption costs (23 percent of total) typically being the greatest expense.¹

In a study of 6,803 insider incidents reported over a 12-month period:

• 56 percent arose out of negligence, with examples of conduct such as failures to secure devices, follow company security policy or to patch and upgrade devices.
• 26 percent were due to criminal insider activity– malicious insiders, including employees or authorized individuals who use their data access for harmful, unethical or illegal activities.
• And 18 percent of incidents involved credential theft to granting access to critical data and software. While credential theft represents the lowest number of incidents, it is the costliest, amounting to an average of $804,997 per incident.

“Insiders” are any individuals – including employees, contractors and vendors, among others -- with authorized access to business systems, data and assets, whether physical or electronic. They pose a threat because they can intentionally, negligently or unknowingly harm an organization as a result of their actions. These actions may include the exposure or theft of assets or proprietary or confidential information resulting in damage to the organization’s operational ability, integrity or reputation, and other financial, business or social consequences.

Our Uncertain Economy Is Not Helping the Situation

The number of companies experiencing insider incidents has risen in each of the past three years. In 2022, 67 percent of companies indicate they experienced between 21 and more than 40 incidents per year, according to a Ponemon study. And the situation is not predicted to improve in 2023.

The current increase in corporate layoffs, reduced compensation and benefits, and widespread economic uncertainty could raise the likelihood that otherwise well-meaning employees may be more likely to act negligently or maliciously in response to layoffs or other adverse changes to their jobs. Disgruntled or resentful workers may find their precarious work situation a rationalization for such activities as intellectual property theft or other criminal acts.

Nearly seven in 10 employees were more likely to take data right before they resigned from their company. Further, there is a 23 percent increase in unauthorized data transfers from employees the day before they were fired, and a 109 percent increase the day they lost their jobs.³

Insider Threat Motivations

Insiders who act contrary to an organization’s interests may do so with a wide range of motives, but common reasons include:

• Political or personal beliefs
• Frustration or anger with the organization or its personnel
• Desire for recognition or financial gain

Insiders who cause harm to an organization do not always act with the intent to so. An insider may unknowingly aid an external actor who uses social engineering – through business email compromise -- to create a false belief through a phishing message asking that funds be rerouted to a different account.

Insiders may act negligently or recklessly, in another manner, when they fail to respect the organization’s security policies or controls, such as using a personal device or account to conduct business, or by allowing unidentified persons into restricted areas.

Additionally, insiders may act with malicious intent. An example of this is the departing employee who takes confidential information with the intent to use it at, or sell it to, a competitor organization.

Nation states may seek to place personnel within an organization, or compromise ones already there through greed, loyalty or extortion, to aid efforts at espionage, theft of trade secrets or other proprietary information, or to cause damage or other harm. They often, target innovative intellectual property or critical infrastructure including energy, manufacturing and water systems or other industries. Nation states use more sophisticated methods to hide their activities and maintain and improve long-term access to the organization.

Recognizing Insider Threats; Signs Your Organization is at Risk

An organization may be at risk when insiders:

• Are not trained to fully understand and apply laws, mandates or regulatory requirements related to their work and how that impacts the organization’s security
• Lack training about the dangers and proper responses to social engineering, such as phishing emails
• Are unaware of the steps they should take to ensure that the devices they use — both company-issued and Bring Your Own Devices (BYOD) — are secured at all times
• Are sending highly confidential data to an unsecured location in the cloud
• Break the organization’s security policies to simplify tasks
• Do not keep devices and services patched and upgraded to the latest versions at all times

Three Steps to Mitigate Insider Threat Risk

^1,22022 Cost of Insider Threats Global Report | Ponemon
³When Employees Leave, Sensitive Data Often Leaves With Them | Bloomberg

About Cyber Solutions
Aon’s Cyber Solutions offers holistic cyber risk management, unsurpassed investigative skills and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets and recover from cyber incidents.

Disclaimer
This material has been prepared for informational purposes only and should not be relied upon for any other purpose. You should consult with your own legal and information security advisors or IT Department before implementing any recommendation or guidance provided herein.