Protect Your Business

New Report Shows 7 Ways Your Employees Can Destroy Your Business. How to Protect Yourself!

No business owner likes to think that their own employees are a threat to the security of their business. But if you don’t take insider threats seriously you could end up blindsided.

A new report by Cybersecurity Insiders, a community of 400,000 information security professionals, shows just how dangerous employees can be to your business. The 2020 Insider Threat Report lays out several security threats that happen from negligent and malicious employees.

How big of a deal are insider threats, anyhow? 

A pretty big one. Over half (52%) of security professionals state that internal attacks are more difficult to detect and prevent than external cyberattacks. This is because by definition, an “insider” attack is coming from someone with legitimate login credentials.

Even if you have excellent IT management for your Phoenix or Tucson business, if a legitimate user is logged into your system, it’s going to be difficult to detect them as a threat until they do something malicious. 

There can be four main reasons for an insider threat:

• Poorly trained employees that have credentials stolen
• Well trained, but negligent employees that don’t follow login policies
• Employees who are just out hurt your company for some reason
• Contractors with temporary access that fall into either of the three categories above

In the case of the poorly trained or negligent employee, the “insider” is actually a malicious outside entity, such as a hacker that’s managed to get a hold of an employee’s login credentials.

So, how do you stop your employees from putting your company in danger of a major cybersecurity breach or malware infection? 

Know what you’re up against and know how to stop it.
How to Stop the Biggest Insider Threats

Here are seven of the biggest threats your employees pose to your business and how to safeguard against them.

1. Poor Password Habits

Did you know that 42% of organizations rely on sticky notes to “manage” passwords? Sticky notes!!

Weak and breached passwords are a major threat to companies because once a hacker has legitimate login credentials their malicious activities can go undetected for months.

Asking users to please use strong passwords just isn’t going to cut it. There are often too many passwords for users to possibly remember. You need to put safeguards in place that can keep even unsecure passwords safe.

The way to do that is to add multi-factor authentication (MFA) to all your logins. Using MFA with a single sign-on (SSO) tool that grants access to all apps after one successful login, can make the process less time intensive.

Microsoft says that MFA stops 99.9% of attempted account hacks.

2. Unsecure Mobile and Remote Connections

Most companies in the U.S. learned just how difficult the security of remote workers could be due to the COVID-19 pandemic. Employees connecting to your network from unsecure Wi-Fi (either home or on the road) are a big security risk.

Having everyone use a business VPN (virtual private network) can add a layer of encryption to all connections, even if employees are on public Wi-Fi at an airport or coffee shop.

3. Use of Shadow IT

Just the name “Shadow IT” says “don’t trust me!” And you shouldn’t… at least not until you’ve had a chance to check it out.

Shadow IT is an application that employees start using for work without getting proper clearance. They may or may not be unsecure, but you have no idea because they’re being used without your knowledge.

79% of professionals say that a security incident is the biggest risk when employees use non-approved apps for work. 

You can nip shadow IT in the bud by putting app usage policies in place for employees and also using a Cloud Access Security Broker (CASB) which tracks all employee app use.

4. Unsecure Personal Devices Used for Work

Many offices rely on employees using their own mobile devices to access business apps and work. But if those devices are unsecure, that invites things like data leakage (data being accidentally compromised) or a malware incident.

Use a mobile device management app (like Microsoft Intune) that can be placed on employee devices to separate the “work” from the “personal” and ensure your apps and data are protected.

5. Having Too Much Access

One big mistake that many companies make is to just assign everyone as an admin so they don’t have problems getting to things they might need. But privilege levels were put into place specially to prevent someone with too much access from doing harm (i.e. a disgruntled employee).

Use the Rule of Least Privilege when setting up new users on your system and cloud apps. This means giving employees the absolute lowest access privilege level possible for them to do their job. This helps reduce the amount of damage any single employee can do.

6. Not Properly Securing Devices

There have been examples of health care companies being fined for a HIPAA violation because an employee left patient information on an open laptop that was unattended. 

Data privacy violations are no joke and can be very costly. Both in fines and lost customer trust.

Put policies in place that require device security, like screen locks and physical security for devices when they’re not in use.

7. Using Lax Document Security 

An employee grabbing the wrong file in a shared cloud storage account could accidentally email your company’s big trade secret to an outside contractor. When sensitive data is compromised, it can lead to major costs. 

A negligent employee can easily expose sensitive data if they’re not paying attention and there are no backstops in place.

Take data security out of your employees’ hands and make it automatic by using a system like Microsoft 365’s sensitivity labels. These label documents and email with a security level as they’re created, and the label applies preset security policies (like watermark or “do not copy”).

Employee-Proof Your Business with Help from ECN IT Solutions 

Don’t run the risk of insider threats destroying your business. We can help you automate your security processes to protect you from threats, both inside and outside your network.

We’re here… just waiting to help you. Reach out at 520-355-7553 or through our website.