Hidden Truth About Cyber-Crime: Insider Threats
Barely a day goes by without reports of another major cyber-attack. Whether the target is an illicit dating site, a leading business, charity or even the British National Health Service (NHS), hackers have demonstrated a level of indiscriminate ruthlessness towards wreaking havoc and stealing confidential information.
The ramifications of these attacks are profound. In September last year, that ride-hailing firm Uber agreed to pay £133m to settle all legal action over the cyber-attack that exposed data from 57m customers and drivers back in 2016.
British Airways was hit in the summer by a breach, affecting 380,000 transactions, involving stolen personal and financial information, but not passport or flight details. Additionally, social media platform Facebook also disclosed that a security breach exposed up to 90m Facebook user accounts in September 2018.
Clearly the problem is not going to go away anytime soon. Last year’s Cyber Security Breaches Survey found that 19% of charities and 43% of businesses had reported cyber security breaches or attacks in the last 12 months alone. This figure rose to seven in 10, or 72%, among large businesses and a similar proportion, 73%, among the largest charities with incomes of £5m or more.
The result of this trend has been a major boost in spending on cybersecurity. Analysis from Gartner has suggested that over $114billion was spent on cyber measures last year, yet successful attacks keep happening. Further data suggested 66% of companies have been successfully breached in the last year alone, with severe consequences.
It’s clear that whilst business leaders recognise there is a problem, research suggests that many have a very limited understanding of the nature of the attacks. Recent research suggested that 61% of CEOs are citing malware as the main cause of data loss when in fact phishing, privilege breaches and compromised passwords are more prevalent.
This cyber blind spot means that many companies have invested in cyber prevention methods, including software and solutions, as well as staff training, yet many are unclear about where these threats arise.
The issue is further inflamed by lax security measures around privilege access, meaning that once a user gets hold of a device, username and password, there are few restrictions around what they can and cannot access.
This is something I have seen time and time again, with many large companies believing that security measures should be framed around the perimeter only. It’s easy for organisations which are not yet operating in the cloud with servers and applications to assume they are safe from harm.
The reality is that unless a business is completely disconnected from the web then it is vulnerable to attack, with malicious hackers able to steal privilege details through brute force or targeted phishing techniques.
Much of the problem stems from the fallacy that the greatest cyber threat to a business comes from an outsider attack, when in fact the opposite is the case. Part of the reason for this is relentless media coverage pointing the finger at foreign nations, international criminal networks and cyber groups determined to cause chaos by any means necessary.
Unfortunately, this assumption of safety means a significant number of IT directors and Chief Information Security Officers (CISOs) still operate believing that traditional security perimeters apply. This is despite the fact that even the use of email accounts changes the game in terms of their company’s security perimeter, putting the safety of the organisation at risk.
Waking up to the reality that the enemy lies within the organisation is the first step towards properly preventing future attacks. We call it Zero Trust, assuming that every user is a potential security threat and mitigating that threat with high levels of proficiency without disrupting productivity.
For example, if a senior member of staff suddenly logs into their account, in a different country or time zone, it’s important that security systems pick this up. It’s also critical that the organisation can alter and manage the privileged access the employee has to confidential data, so that this is reflective of their managerial level.
Failure to adopt this approach could allow a malicious hacker unprecedented access to a goldmine of confidential company information. In which case, by the time the company realises there is a problem, it is already too late.
Many large-scale organisations store critical passwords and data within the company ‘password vault’ and gaining access to this area of the business is seen as a goldmine for would-be hackers.
Yet many security providers in this space would have you believe that gaining access to the relevant passwords and breaking into the company password vault is the be-all-and-end-all of privileged access management.
The reality is companies must now look beyond the password vault in terms of adopting a Zero Trust approach, focusing instead at the individual, their device, log-in activity and question their levels of access to critical company data.
Moving forward, it’s critical that company leaders assume that all employees are a potential threat. Practical steps for this approach must mean authenticating, auditing and granting access when the company is certain that the user is who they say they are.
A healthy sense of paranoia is the only way for organisations to properly protect critical data, this means recognising that the threats can come from any employee or device, at any time.
In an increasingly dangerous digital world, assumptions about user identity is a major risk. Businesses need to think long and hard about who exactly is entering their systems, what they are viewing and the associated security risks.
The hidden truth about cyber-crime is that the majority of companies have no idea about exactly where these threats are coming from. Failure to wake up to the reality that privilege attacks are one of the biggest risks will leave companies open to major attacks, unable to respond until it’s too late.
You Might Also Read:
Take An Analytical Approach To Cybersecurity Training:
