The high risk of data loss associated with employees

The security threat from insiders is growing.

Consider the most recent Verizon Data Breach Investigation Report (DBIR), which found that 20% of cybersecurity incidents and 15% of data breaches investigated within the Verizon DBIR originated from people within the organization.

According to Verizon’s DBIR analysis, the top motivators behind insider attacks were financial gain (48%) and pure fun (23%). “These attacks, which exploit internal data and system access privileges, are often only found months or years after they take place, making their potential impact on a business significant,” Verizon said in a statement issued earlier this year when it published its report.

In a separate, more recent survey created by data loss protection provider Code42, the 2019 Data Exposure Report uncovered some interesting trends in insider data leakage, as well as the attitudes of executives when it comes to insiders and data security.

The report, which is based on a survey of 1,028 information security leaders and 615 business decision-makers, found that of the 38% of companies that were victimized by a data breach in the previous 18 months, half said employee actions were the root cause.

Sponsorships Available

Sponsorships Available

Sponsorships Available

For information security leaders, the insider cause of data breaches (50%) was followed by third-party actions (45%), external malicious actors (28%), software failure (27%), hardware failure (20%) and unpatched software vulnerabilities (20%).

It was interesting to see that nearly 63% of survey respondents admitted to taking data from a prior employer and 57% of information security leaders and 51% of business decision-makers say that their colleagues have infiltrated data from their prior employer. This practice places organizations at significant legal risk.

That does make one wonder: If it’s common for employees to have taken data from their previous employers when they left, they’re just as likely to take data from their current employer to their next employer in the future.

Perhaps part of the reason for such high levels of data sharing is that employees, even executives, view an organization’s data as something that belongs to them. Surprisingly (to me, at least) is the finding that 72% of information security leaders and 71% of business decision-makers agreed that it’s not just corporate data, it’s their work and their ideas.

Finally, while security awareness training is often something thought of for front-line employees, IT decision-makers and business decision-makers — 54% and 46% respectively — both admitted that they clicked on links they shouldn’t have. And, stunningly, 78% of CSOs and 65% of CEOs admitted that they, also, clicked on links that they should not have.

Recent events (and these surveys) highlight the dangers of insider threats. But it’s important that all types of risks from insiders — beyond malicious actors and attackers — be considered, and that security awareness training target everyone in the organization, from front-line workers on up to top executives.