In this piece, insider threat prevention expert Isaac Kohen, founder & CEO of Teramind presents why controlled access alone won’t keep a business safe and proactive steps that companies can take to implement a multi-tiered security process to keep company assets and information safe at every level within the organization.
Whether intentional or malicious, insider threats are one of the most costly and dangerous risks businesses face, according to a report released by IBM. In an attempt to counter this widespread attack on privacy and security, newer and better security measures have been implemented, with access control at the forefront.
Access control is an internal system that keeps information guarded behind password-protected gates. Only users with proper permissions can access the information. Access control can be set up in graduating tiers, with the most sensitive information reserved to only the most privileged members of the organization.
What businesses are learning, however, is that while controlled access is a step in the right direction, when used as a standalone form of protection, it leaves many areas at risk and ripe for attack.
Here are some of the reasons why controlled access alone, is not enough:
Privileged Doesn’t Make You Reliable
Recent data leak scandals such as Snowden, Morgan Stanley, and the Panama Papers reveal an unfortunate reality: privileged doesn’t mean trustworthy. High level executives are not immune to corruption. It doesn’t help to limit privacy access of confidential files to those in higher positions, if managers and themselves have repeatedly proven that they are not above leaking or selling private company information.
Reliable Employees Also Pose a Risk
Even trustworthy employees often invite security breaches, due to lack of security awareness as well as carelessness. In fact, according to a Ponemon Report released last year, a dizzying 79% of risk comes from company employees and executives simply not adhering to basic security best practices. Failure to properly log out of a system or choose a correct password can provide unintended access to private company materials. Downloading an unidentified external file, can place the whole company at risk of a ransomware attack, resulting in one very expensive mistake.
Limiting Permissions Can Stifle the Workflow
Businesses are constantly struggling to strike a workflow-security balance. While on the one hand organizations need to be protected from security breaches, as this is a real and prevalent threat, they also cannot afford to place overly stringent security measures. Employees that are asked to comply with an extraordinary number of security compliance procedures are proven to experience a decline in work productivity due to all the system passwords, permissions, and logins they now need to comply with.
Quite often, a decline in employee morale ensues as well, as having to comply with so many procedures can be frustrating and can cause resentment. In fact, a recent BetaNews publication cites an employee survey of 6,000 European citizens of whom 51% experienced a decrease in employee morale due to overly restrictive workplace technology and its impact on employee job dissatisfaction.
Implementing restrictive software alone is not enough to solve the problem, as it does not address the various issues cited that lie within the company. A more holistic approach is therefore required, one that will addresses both internal and external threats by understanding where they emanate from, and then protecting against their development and effectiveness. The following points should be considered:
- Employee profiling
Specific types of employees are more prone towards breaches than others, making employee profiling an essential security measure. Whether due to high company frustration levels, carelessness, or frequent violation of company protocols, certain employee profiles have been proven more susceptible to privacy breaches, and therefore require additional monitoring. This important security step can cut off a breach before it happens, saving businesses tremendous amounts of time, money, and brand integrity.
- Fostering employee awareness
Educating your employees is an important first step towards safer and more reliable work practices. Businesses need to make employees aware of security best practices, as well as make those practices a regular part of the company culture. Frequent measures such as email updates, helpful tips, and policy reminders keep these important security procedures at the forefront of everyone’s minds.
- Enforcing consistent company policy
Once employees are aware of the obstacles, strict policies need to be drafted and enforced. Companies are learning that properly enforcing security policies is no longer a luxury but a necessity. With millions of dollars at stake and a business’ reputation on the line, companies cannot afford to be lax in taking action when policies are breached. As Michelle Drolet put it, “It’s not the name before the ‘@ sign’ that’s going to get in trouble; it’s the name after [it] that will.”
- Employee behavior monitoring
Monitoring employee behavior against common worst practices is one of the single most effective ways to protect against unintentional (or malicious) data leaks. Frequent missteps include connecting external devices to a secure network, logging onto personal email or social media accounts, and sharing files via unsecured channels. Employee behavior monitoring tools track all employee activity, pinpoint which behaviors are potential threats to your organization, and notify you immediately so action can be taken to prevent a breach.
Implement a multi-tiered security system, and keep your trade secrets, merger information, financial briefs, and other sensitive data safe.
Visit Teramind at Infosecurity Europe 2017, stand no: Stand: F280