Insider attacks

We tend to think of security threats to a business as originating outside the organization. In fact, the largest financial threats to business institutions come not from robberies but from embezzlement by insiders. Bank employees steal far more money than bank robbers. The same is true for e-commerce sites: some of the largest disruptions to service, destruction to sites, and diversion of customer credit data and personal information have come from insiders — once trusted employees.

Employees have access to privileged information, and, in the presence of sloppy internal security procedures, they are often able to roam throughout an organization's systems without leaving a trace. Research from Carnegie Mellon University documents the significant damage insiders have done to both private and public organizations. Survey results indicate that insiders are more likely to be the source of cyberattacks than outsiders, and to cause more damage to an organization than external attacks.

In some instances, the insider might not have criminal intent, but inadvertently exposes data that can then be exploited by others. A Ponemon Institute study found that negligent insiders are a top cause of data breaches. Another study estimated that 1% of employees are responsible for 75% of cloud-related enterprise security risk, by reusing or sending out plain-text passwords, indiscriminately sharing files, using risky applications, or accidentally downloading malware or clicking phishing links.

Defending against insider attacks is challenging because insiders legitimately have access to the systems they attack. Controls include principle-of-least-privilege access policies, monitoring of privileged activity, separation of duties, and prompt revocation of access when employees leave the organization. Laudon and Traver note that PKI is not effective against insiders who have legitimate access to corporate systems and customer information — a key limitation of technical solutions.