Employee Mistakes and Insider Theft Account for Big Part of Cyber Breaches

A recent poll by Deloitte shows that IP cyber thefts are expected to rise in the next year, with fully 1 in 5 respondents saying they believe the crimes will likely be inside jobs. 58 percent of nearly 3,000 polled professionals, most of them in the accounting and financial sectors, believe that the number of insider cyber thefts and breaches will continue to rise in 2017. Those polled professionals in the telecom and power/utilities industries were the most numerous segment of the poll (68.8%) in believing that such cyberattacks will increase.

Sad freelancer working with a laptop

“While many of us know — or have experienced firsthand — how a cyberattack can severely disrupt business, loss of an asset as critical as IP can be crippling for most organizations,” says principal at Deloitte, Don Fancher.

IP Cyber Theft – The “Silent” Perpetrator

All too often, IP cyber theft incidents go unreported, because it has relatively little direct impact on the public, and because companies hit by IP cyber thieves would rather keep their losses undisclosed, says Deloitte. And because it consists of digital copies of data rather than hard printouts of IP, the extent of cyberattacks is often difficult to accurately assess.

“Managing risk often includes qualifying how loss of that IP would impact the business, preparing to identify and pursue adversaries, and building a defensible chain of data custody to counter future IP cyber-theft threats,” Fancher says.

Deloitte poll respondents put the automotive industry at the highest risk of insider cyber threat (32.2%), followed closely by the oil and gas industry (27.2%), and real estate service industries (26.2%).

“Predicting IP data theft is tough, as adversaries don’t fit one specific mold,” said Adnan Amjad, a partner at Deloitte.

Evaluating the Insider Threat

Insider cyber threats are responsible for 43% of data breaches, with a 50/50 split between intentional and accidental breach occurrences, as reported in Info Security Magazine. And, the bigger the organization, the bigger the chance that an internal actor (employees as well as associates within a given enterprise) will trigger a cyber breach. But, even a small business with five employees has two “internal actors” that will commit a cyber breach at some point – either intended or unintended.

Data Breach Impact on Businesses

One statistic given by Intel shows that 68% of data breach incidents were serious enough to require public disclosure regarding the exfiltration of exploited data, with a huge attendant chance of having a negative impact on the company.

“Most security studies and statistics focus on infiltration, or how attackers are getting past security defenses and into the network,” explains the Intel report. “That part of the attack is more visible, compromising machines and triggering events and alarms in the security operations center. Until now, there has been very little information available on the less visible act of data exfiltration: how attackers are removing data. Whether you see it or not, data exfiltration is a real risk for most organizations.”

This unequivocal data on insider cyber breaches has caused a huge upsurge in companies buying cybersecurity insurance policies during 2016.

Insider Data Breach Quick Facts

• 25% of data exfiltrations used file transfer or tunneling protocols, such as FTP or SCP.
• 32% of data exfiltrations were encrypted.
• 25% of stolen data were Microsoft Office documents.
• 64% of security professionals felt data loss prevention (DLP) technology could have prevented their data exfiltration events.
• 40% of exfiltrations were theft of physical media.

(Source: Info Security Magazine)

Need Help Fighting Insider Cyber Threats?

If you need assistance with optimizing your cybersecurity strategies and internal threat analytics, you can speak to a cybersecurity specialist at {company}, which is a proven leader in providing IT consulting and managed services in {city}. {company} can help implement employee training and alerts set up to track odd logins and big downloads. A Managed Services provider can also help with the monitoring and alerts on a 24/7 basis so that the business does not have to hire someone to work off hours. Contact one of our helpful IT experts at {phone} or send us an email at {email} today, and we can help you better evaluate and prevent insider cyber breaches.