Insider Threat to your Business
Who poses the biggest cybersecurity risk to your business? If your first thought was a Kremlin cyber-warfare unit, or a dark-web king-pin, you are wrong. The most likely source of a data breach at an SME is one of its own employees aka the insider threat.
According to recent research 54 per cent of breaches at small and medium-sized businesses come from an employee or contractor’s negligence. The number, alarmingly, had increased from 48 per cent when firms were asked the question a year earlier.
If you add in the 7 per cent of breaches that are caused by malicious insiders, then 61 per cent of all data breaches come from people on a company’s own payroll. That is almost double the number that are caused by hackers, who account for 33 per cent.
In reality the number which originate from employees could even be higher – in an astonishing 32 per cent of cases firms said they couldn’t even determine the root cause of a data breach. That is arguably the most disturbing statistic of all. If you don’t know how your data leaked, how can you protect yourself in future?
SMEs were asked: What was the root cause of data breaches at your company?
How do employees cause breaches?
Those numbers might surprise you, but in our experience they ring true. So how do employees cause breaches? Generally, there are three ways.
The first is carelessness. There’s a hundred ways to lose a laptop. Someone can leave it on a train or in a pub, and if the password is easy to guess it can be a goldmine. Once a thief is in you can be certain that he’ll strip it of every bit of data he can – emails, passwords, addresses, dates of birth. Given that he’s already nicked a laptop, he probably won’t hesitate to flog the lot to a fraudster.
The second is being too trusting. On their private email people are always on their guard for phishing emails. But work ones? The company’s systems will filter out anything dodgy, won’t they? It is because people make this assumption that phishing attacks from work emails are so successful. Once they are in, fraudsters don’t exactly shout about it. We’ve all heard too many stories about high-turnover businesses who didn’t realise for months that money was being nicked.
The third common cause of data breaches is revenge. It’s far less common than a cock-up, but as I mentioned above, it accounts for 7 per cent of data breaches at SMEs. If a disgruntled employee decides to pinch personal data or mangle your CRM system, for example, the damage could be irreparable.
How can we help ?
It’s not too difficult to stop any of this happening. All you need are proper systems and training, but we see time and time again that SMEs decide that they can save money on IT security. That’s understandable, but the cost of not doing it properly could be far higher.
To talk to us about how to protect yourself from the insider threat and data breaches today by getting in contact with us here or calling 07958 545129
Really interesting reading and just shows the importance of security – unfortunately another thing that’s often overlooked until its too late
Very interesting blog post Neil and shocking numbers.
Shouldn’t SMEs be training employees and having monitoring processes in place to minimise careless errors?
You find that larger businesses, maybe 500+, generally have an education plan in place for their employees, when it gets down to the smaller number businesses, this is where it fails sometimes.