Is your data truly secure?
The traditional rules of protecting your business change when you are looking at internal threats.
External attacks can be protected against with the use of technology and security mitigations, but internal threats are different.
However, these threats can often be hidden in plain sight.
Interpersonal threats will need to be countered with data, knowledge and insights. This is important because internal breaches are generally caused by humans and while some cases are malicious many are pure human error.
Humans are always going to make mistakes even when they try their hardest not to and there is no technology or patch that can fix this.
Employees are unpredictable and they can be tempted to do something silly or make a bad choice. They can also make mistakes even when they have all the training you can provide and the security knowledge that they need.
Let’s unpack why you need to be aware of data breaches from your internal team.
What causes data loss?
According to McAfee, internal actors are the cause of 43% of data loss incidents. Half of these breaches were intentional while the other half is purely accidental.
The internal actors who cause these incidents include employees, third-party suppliers and contractors. The incident rate is split 60/40 between employees/contractors and third-party suppliers.
A recent study confirmed these findings, and even increased the total risk to 74% with 42% of this risk coming from employees alone.
For Australian architect Michael Yousef, he says that losing data would set his business back by months. “Architects have so much data stored on our computers. All of our plans, designs, everything. That’s why it’s critical to be prepared for everything and ensure you have back-ups of back-ups.”
Where do the greatest risks come from?
When considering the healthcare industry alone, it faced the greatest risk from internal actors than any other industry.
Of the incidents reported in the last year, 56% were caused by internal actors while 43% were from external attacks. Human error is a major component in these statistics.
There are some cases where human error overlaps with malicious intent. This is generally employees who are abusing their access to the healthcare system and the data it holds. However, 13% of cases like this had fun or curiosity as their driving factor.
An example of this would be checking where a celebrity was recently a patient.
According to recent reports, in the last quarter of 2017, there were 957 data security incidents in organisations across Australia. Not all of these reports are caused by human error, however the incidents at the top of the list were. These included:
- posting or faxing data to the incorrect person
- emailing data to the wrong person
- failing to redact data or use blind copies when emailing
Which industries are most at threat to data breaches?
The industries that saw the highest number of data security incidents in the last quarter were education, general business and local government.
For Sonaa Abseiling, a high-rise building maintenance company, losing the data for their client base would spell bad signs for their business. “If someone was to expose our client list, or worse, take it for their own company and offer them lower prices, we couldn’t compete and we’d be done for. Data breaches are something we ideally don’t want to worry about, the facts are that we have to. Whether we like it or not.”
In the last quarter of 2017, the education sector had 12 unencrypted devices stolen or lost while the healthcare sector had 11. This is a clear sign that it is impossible to achieve complete cybersecurity perfection even with the widely publicised incidents which have occurred. Human error, carelessness and mistakes still persist and are unlikely to abate.
How to protect your data
While tackling the rise in cyber-attacks and the constant threat from the human vulnerability of business, companies have to be able to detect problems early. The best place to start with this is understanding what normal for the business is. The best data to use for this is user analytics.
Companies can make use of machine-based learning to create a baseline of what is normal for every employee. Common trends can be mapped and when there is activity outside these parameters, it can be flagged as a potential issue. A few actions could be harmless on the surface, when they are put together they could ring alarm bells.
An example of this is when a user logs into the intranet at a time that is unusual for them and from an unrecognised device. The user then downloads a large amount of data onto a USB stick. Each of these actions on their own can seem acceptable, but when placed together they are a clear sign that something is wrong and there is a data extrusion taking place.
The team at Sydney Detox And Rehab relies on protecting sensitive data related to patient’s health records. They note “something as simple as adding tracking software to workplace computers can mitigate against the risk of data breaches. While human influence – both accidental and malicious – is impossible to avoid. You can minimise it.”
Of course, situations relating to human error are never simple.
The event may not be malicious, but there is a knock-on effect that the user or business might not consider.
This is why companies need to use behaviour analytics as a logical solution. Machine-based learning will be applied to mitigate all types of risks from the ones you expect to those you do not.
The more data provided, the better the insight and the mitigation on offer.
The Best Of Australia 