When prompted with the word “hacking,” often times, people’s first thought is of a guy sitting in the dark on his laptop trying to access a company’s server hundreds of miles away. However, according to Infosecurity Europe, 42% of security professionals consider hack attacks to come from day-to-day activities like insider threats. Although the media often talks about hack attacks as though many of them come from far off lands, in reality, many of the successful attacks come from an insider data breach—the 2014 J.P. Morgan hack being a prime example. For many hack attacks, the assailants are actually much closer than most think.
Infosecurity Europe released its 2015 Industry survey in April discussing how organizations perceive cyber security threats to their businesses as well as their prevention and security strategies. According to a group of 1,336 enterprise web security professionals, 32% of respondents believed that the greatest risks to their organizations were external attacks like the ones that we imagined before—with strangers orchestrating them. These attacks include DDoS, malware, injection attacks, etc. However, the second largest concern at 21% was insider threats, which consist of careless or malicious employees, privileged users, and third parties. These people all have something in common—they have access to administration rights to the company’s server or web apps. They are the ones working on these assets, developing them and importing or exporting customer personal information.
With the increase in hostility in the cyber environment, where companies cannot even trust their own employees, 72% of cyber professionals are now calling for more risk-based approaches in information security. With 61% of them assuming that their own employees are the source to internal data breaches, they want to create internal security infrastructures that actually protect their systems from employees as well. Traditional methods like training employees about web security is no longer enough— as insider threats are now responsible for 43% of data breaches. So now, enterprises are looking to develop and launch information security systems that shield them from the very employees that helped build them.
While these companies admit that building a culture around information security is important, they stress the importance of creating systems that protect their sensitive data. One method to protecting their data is proper authorization. As the J.P. Morgan hack started with an employee’s username and password being used to send millions of customers’ information to hackers, if an employee is granted such high-level rights, customers’ personal data can be compromised. Companies need to decrease employees’ admin rights, so they cannot access or import customers’ credit card or account information.
Investing toward information and web security is critical. However, sometimes hacks do not always come externally. As the number of internal data breaches continue to increase, companies need to invest in internal security methods to prevent precious customer data from being compromised and ultimately, damaging the companies’ reputations. Internal security methods can start with granting proper authorization rights to employees—no employees should have free access to customers’ personal identifiable information like credit card or account information. Once companies limit this access, then we are one step closer to a safer cyber environment.