In many a horror movie it is thought the bad guy is on the outside when actually the villainous protagonist is lurking inside. The same is so for enterprise cybersecurity. It follows that more companies are taking notice of the risks that insiders can pose to the company’s data security.
It follows that many organizations have, often mistakenly, put their time and effort into defending fixed perimeters. However, the chances are good that the threat already exists on the enterprise network, according to research published in TechRepublic.
Examples of insider threats include deliberate attempts to steal it or leak data. If someone wants to do this, then they can usually do so with far greater ease than outsiders. People leaving jobs who are disgruntled or former employees who hold a grudge can be the types of people motivated to cause harm.
However, the main insider risk arises from insiders who end up accidentally leaking data or engaging in behaviours that end up putting data at risk. Examples include attaching the wrong file to an email being sent, sharing the wrong thing on social media, losing a laptop or USB drive, or another kind of error that puts an organization’s data at risk.
A related risk area is relying on consultants who may also remove data without checking or introduce hardware of software that has not been correctly vetted.
This reality calls for an entirely new kind of cybersecurity posture, one in which businesses remain vigilant at all times and view their environments as if they have already been compromised. This is drawn out in the Unisys Security Index for 2019. The review also calls for new solutions that can quickly and dynamically isolate threats within enterprise IT environments.
In line with National Cybersecurity Awareness Month there is a call for enterprises to better protect themselves from both outside and inside threats by employing a zero-trust posture, which involves the use of dynamic isolation and microsegmentation technologies.
