How Disgruntled Insiders Pose a Serious Threat to Your Business-Critical Data

Merely mitigating external cybersecurity threats isn’t enough when it comes to fighting cybercrime in today’s ever-evolving threat landscape. Although insider threats can be as devastating and as deadly as their external counterparts, most businesses fail to track and manage insider threats adequately.

As per the Data Exposure Report 2021 by Code42 and the Ponemon Institute, a mere 46 percent of organizations have an insider risk response plan (IRRP), of which 71 percent apply it inconsistently or on an ad hoc basis. The report also revealed that the likelihood of employees leaking files has jumped 85 percent since COVID-19 hit. In light of this, it can be incredibly foolish to turn a blind eye towards fighting insider threats, especially at a time when such threats are increasingly rampant.

Tackling insider threats should be the top priority of your cybersecurity strategy and it is imperative that you find ways to curtail the damage caused by a data breach due to these threats. Only when you’ve undertaken consistent and comprehensive measures to tackle this menace will your business be significantly safer.

This blog will help you understand how you can save your business-critical data from malicious and/or criminal insiders, so make sure you clear your schedule for the next few minutes and pay close attention.

The Enemy Within

Insider threats are risks that your business faces from the inside – either in the form of malicious insiders or insiders who unwittingly end up jeopardizing the security of your business.

According to Verizon’s Insider Threat Report, some of the various types of threats you must be wary of include:

• Careless workers: Someone who misuses assets through resource appropriation, mishandling data, installing unauthorized applications, breaking acceptable use policies, etc.
• Inside Agents: Someone who steals information to benefit one or more third parties through exfiltration of company data.
• Malicious Insiders: Someone who uses their access privilege to steal and use information for personal gain.
• Feckless Third Parties: An irresponsible third party, such as a business partner or a contractor, who compromises an organization’s security through malicious or negligent access, assets or information.
• Disgruntled Employees: Someone who disrupts operations or destroys property or data to harm their organization.

In the following sections, we will focus on disgruntled insiders to help you understand what motivates them to carry out attacks and the potential damage these attacks could do to your business.

How to Identify a Disgruntled Insider

A disgruntled insider often displays one or more types of high-risk behavior, which you must be vigilant about. Some of them include:

• Expressing dissatisfaction over a poor performance review: It is highly likely that an employee who has taken a performance review very sourly might turn into an insider threat, especially if the review leads to him/her being relieved from the job.
• Feeling unequal among co-workers or feeling he/she is treated unfairly: An employee who exhibits staunch dissatisfaction over the way he/she is treated with respect to other co-workers could classify as a potential insider threat.
• Feeling dissatisfied with the job at large: It should come as no surprise that an employee dissatisfied with his/her job, with regards to financial compensation or any other factors, could also be a potential insider threat.
• Leaving the company abruptly: While this may not count as a type of behavior per se, an employee leaving the company could cause damage while on his/her way out for various reasons. Please remember that until an employee’s access privileges are fully revoked, he/she still counts as an ‘insider.’

Tracking and managing such behavioral patterns may seem daunting but the longer you sit on it, the greater the chances of a disgruntled insider making your business pay a hefty price.

How Disgruntled Insiders Can Wreak Havoc

A disgruntled insider that is committed to disrupting your business can cause lasting damage by:

• Exfiltrating business data before leaving the company to work for a competitor
• Deleting critical data or incriminating evidence
• Leaking or exposing private/personal customer data or business IPs to the public or on the Dark Web
• Enabling or causing damage to physical or digital equipment, systems or applications, or deleting/destroying data and information assets

Here are a few examples of how security breaches caused by disgruntled insiders cost businesses dearly:

In 2020, an ex-vice president at Stradis Healthcare was accused of gaining unauthorized access to the company’s package shipping system. He modified and deleted documents on the shipments of personal protective equipment (PPE) to healthcare staff.

In the same year, two members of the Shopify support team misused their access rights to obtain data on customer transactions for nearly 200 merchants. The data contained personally identifiable information (PII) of the customers. Shopify’s stock price saw a 1.27 percent drop post the incident.

In 2018, an ex-employee named Danielle Bulley gained unauthorized access to her company’s Dropbox account and permanently erased over 5,000 records – causing irreparable damage to the business and forcing it to close. She was sentenced in June 2020, nearly two years after the incident.

Tighter Security + Robust Backup & Recovery = The Protection You Need

Doubling up on IT security and devising a contingency plan for insider threats should be the order of the day. While implementing stronger security measures, such as stricter access management and ongoing risk management, would be a great start, availing a robust enterprise-class backup and disaster recovery solution will boost your defenses immensely. It will ensure your business-critical data is backed up regularly, protected from malware or insider threats and quickly recoverable in the likelihood of a breach. However, you will have to devise a strategy to monitor and test it regularly to determine its efficacy.

While this may seem like a tedious job, just remember that you aren’t in this fight alone. An experienced MSP partner can help you not only ward off insider threats but also help secure your business-critical data with a strong backup and disaster recovery setup. We’d love to step up to the plate to help you and your business get safer and stronger. Simply send us a short email and let’s get this ball rolling.

Article curated and used by permission.

Data Sources:

• https://www.zdnet.com/article/disgruntled-former-vp-hacks-company-disrupts-ppe-supply-earns-jail-term/
• https://techcrunch.com/2020/09/23/shopify-data-merchant-breach/
• https://northyorkshire.police.uk/news/businesswoman-sentenced/

‍