Insider attacks

We tend to think of security threats as originating outside the organization, but in fact the largest financial threats to business institutions come not from robberies but from embezzlement by insiders. Bank employees steal far more money than bank robbers. The same is true for e-commerce sites: some of the largest disruptions to service, destruction to sites, and diversion of customer credit data have come from insiders — once trusted employees.

Employees have access to privileged information, and, in the presence of sloppy internal security procedures, they are often able to roam throughout an organization's systems without leaving a trace. Survey results indicate that insiders are more likely to be the source of cyberattacks than outsiders, and to cause more damage to an organization than external attacks.

In some instances, the insider might not have criminal intent, but inadvertently exposes data that can then be exploited by others. A Ponemon Institute study found that negligent insiders are a top cause of data breaches. Another study estimated that 1% of employees are responsible for 75% of cloud-related enterprise security risk, by reusing or sending out plain-text passwords, indiscriminately sharing files, using risky applications, or accidentally downloading malware or clicking phishing links.

Defending against insider attacks is challenging because insiders legitimately have access to the systems they attack. PKI is not effective against insiders who have legitimate access to corporate systems and customer information — a key limitation of technical solutions. Effective defenses include least-privilege access, monitoring of privileged activity, and separation of duties.