GEC NEWS WIRELt. Col. Saeed AlShebli, Deputy Director of Digital Security, Ministry of Interior, UAE, discusses strategies to mitigate risks from internal threat actors.
Although external threats are a significant security concern for organizations since they cause severe consequences, there are other much more serious concerns. These are insiders within the organization who have access to and knowledge of the organizational data and systems and, at times, have the malicious intent to disrupt the integrity, confidentiality, and availability of the data and systems. Distinguishing between internal threat actors, understanding their motives, and identifying ways to address them is essential for preparing for such threats.
Internal threat actors can be categorized into three main types: malicious insiders, negligent insiders, and compromised insiders. Malicious insiders have purposefully ill intentions and perform damaging activities like stealing data, sabotaging, or spying. They include an employee who feels that the organization has wronged them and take their time to ensure that they bring the organization down, employees who are hired by other organizations with the sole aim of stealing important information from the organization, and last but not least, the internal hacker who takes advantage of the weak links in the system to enrich himself.
While the former refers to negligent insiders with ill motives and gain from the harm caused, the latter involves careless insiders who do not bear any ill will but harm others through their actions. This group comprises those who are negligent about security or overlook security policies or guidelines, those who get tricked into clicking on the wrong links, like phishing, and those who have not been trained on security matters. Their sometimes careless actions lead to extreme consequences that make the organization vulnerable to security threats and data leakage. These insiders may have their credentials compromised or are otherwise unaware of the intrusion by an external actor into the organization. Such insiders might not even know that their accounts are being employed for the intended criminal activities, which complicates the identification of the threat.
The reasons individuals may engage in internal threats could be numerous and often not as straightforward as one may think. Greed is another motivation, with people stealing information to make money from it through sales in the black market or benefit from it in other ways. Another important consideration is the desire to get revenge when an employee wants to punish their employer for the perceived or actual mistreatment. Tapping is the act of espionage, whether corporate or governmental, where one aims to obtain information belonging to a competitor or an enemy. There are also ideological motives: an actor may act due to personal conviction or for political purposes. Finally, some insiders engage in private gains by utilizing organizational resources for self-serving purposes, for instance, using the organization’s equipment or information for personal research.
Mitigation strategies
Organizations must undertake several strategies to reduce the threats posed by internal threat actors. The other important factor is ensuring good practice on access control since it follows the principle of least privilege, where the user is only allowed to access the information and resources relevant to the user’s job description. This approach reduces the exposure of networks to unauthorized access or other security threats that may lead to breaches; it is a critical factor in an organization’s cybersecurity solution. Security awareness training is vital for developing the security culture within an organization. According to NordLayer, there should be training on security, phishing, and data safety. Security training is conducted regularly and emphasizes security issues. Periodic security drills and assessments help to remind people about the security training and maintain a high level of security awareness.
Recording and supervising activities that take place in the organization are essential. Having efficient systems of logging and monitoring the activities within an organization and SIEM systems can help identify signs of an internal threat. DLP solutions build upon these measures and offer more security by preventing users from copying, transferring, or leaking data. MFA is the process of enhancing security by using multiple methods to verify a person’s identity, especially when it comes to accessing systems or data. Background checks performed before hiring and routine background checks for employees working in the organization for some time can also help establish risks.
One of the most important aspects of any organization focusing on security issues is the presence of clear policies and procedures. The companies should ensure that they have formulated and implemented sound security policies, with the staff fully aware of the repercussions they face if they breach the policies. Creating an insider threat program with a team focusing on insider threats can significantly improve the organization’s security. Fostering a concern with the security environment and ensuring that everyone is constantly monitoring for risks are additional essential actions.
Detecting and Responding to Insider Threats
There is an excellent emphasis on detection and response regarding internal threats. Behavioral analytics tools can help to detect any anomaly in the behavior of insiders that may signify threats. These tools are based on deviations from typical activity and are designed to identify risks in the early stages (What is an insider). There must be an incident response plan for the insider threat. This plan should be reviewed periodically, and measures should be outlined to contain and investigate the incident and handle the aftermath. Promoting awareness of suspicious activities among the employees makes them aware of their security environment. Whistleblowing procedures may include anonymous reporting, which helps keep the possible threats protected and safe for the whistleblower.
In conclusion, internal threat actors are one of the organizations’ most significant security risks. Knowing the different types of internal threats, their motives, and the proper ways to deal with them helps organizations avoid these dangers. Internal security should be an ongoing and systematic process as the organization’s essential resources, information, and data must be protected regarding integrity, confidentiality, and accessibility.
