Cybersafetyconnections March 13th, 2023, Vol#109
- Another week of the enemy within with insider risk management.
- Microsoft CISO Insider Threat Risk Management perspective.
- Success begins with people first, then backed by tools.
Emeny Within
Two weeks ago, we discussed insider risk in the blog The Enemy Within Cybersfetyconnections February 27, 2023, vol#107 .
As stated, cyber threats have increased due to our digitally transformed life. The remote and hybrid work model has opened us up to the threat of cyberattacks in both our personal and professional lives.
Talk about cyberattacks from malware, and ransomware that comes in form of phishing emails, smishing, and vishing that affects our mobile devices, critical infrastructure, and supply chain. And no one is too small or too poor for these cyber criminals.
While the emphasis had been on external cybercriminals, our remote and hybrid work life has introduced the insider threat factor in form of employees.
With so many devices remotely connecting and gaining access to company resources/data, creating, sharing, and storing data, there is the risk of a data breach due to error or intentional acts.
An example is the case of CashApp data breach in 2022 where is an employee that was let go gained access to data of about 8.2 million current and former customers.
Microsoft CISO
This blog focuses on insider threats from an article by Bret Arsenault Microsoft’s chief information security officer (CISO) in Harvard Business Review titled “Your Biggest Cybersecurity Risks Could Be Inside Your Organization”. This involves organizations working alongside employees, processes and tools in the fight against cyberattacks.
Here are some guidelines for such a program implemented at Microsoft by the CISO.
1. Make employee trust and privacy count
This involves creating policies and privacy controls that will not only help but keep trust and ensure privacy. There has to be a balance between privacy and company security.
It is not advisable to just randomly monitor employees’ activities which may fall under the invasion of privacy and chip away at trust.
While it is important to monitor the insider threat, it is also important to do it in such a way as to still treat employees with respect and keep trust. Employees need to know that they are being protected as well.
Even when investigating, it is advisable to be careful about who has access to the compliance information to maintain privacy.
2. Cross functional collaboration
While the IT and Security group will lead in the cybersecurity efforts, the cyber breach affects all parts of the organization, so it is good to involve other departments like Legal handling upcoming regulations and HR doing training programs and surveys.
This will lead to gaining wider support and provide different perspectives. The cyber breach response plan should show how information is to be shared, when it should be shared and which group should share, decision-makers, and the line of reporting.
There should be measures to show if these efforts are successful. For example, the number of cases, false and true positives, and the action that followed.
If there are a lot of false positives, HR and Legal may be going after false alarms that cost time and money.
3. Insider line of defense
Employees must get the awareness and training they need to help in cybersecurity efforts. Employees should have a sense of ownership and feel they are trusted partners in this cybersecurity effort. This training should not be one-off but ongoing.
In our personal lives, we learn how to protect our data. This can be a pivotal point in employee training to show how the same stewardship efforts can help with company cybersecurity efforts.
You know the adage “see something, say something? If used properly, it will turn employees into ambassadors of cybersecurity. Employee cybersecurity awareness and training help them to become the first line of defense for the company alongside technology detection tools.
4. Machine Learning with less and resources
Insider risk management according to Gartner, paraphrased are tools and capabilities that try to measure, detect and contain risky behavior of accounts inside an organization.
Prior risk management tools overlooked some behavior that could be risky to the organization, had strict controls that reduced productivity, and employees could find ways around it.
Current risk Management tools are more precise,effective and adaptive being able to detect cyber threats and reduce their impact while working behind the scenes and maintaining the privacy of users’ information.
Now just printing documents may not be something risky but if the document is renamed and deleted after printing, that may raise a red flag. Using machine learning tools can reduce false positives and make detection more precise, helping to focus on the real risk.
Success with people, processes, and technology
Organizations need to manage both external and internal cybersecurity risks to succeed. The issue with insider risk management is people, processes, and technology are involved.
While tools can help prevent, detect, and respond to cyber threats, it does not solve the real issue. This is where the people part comes in. Providing awareness, training, and creating a work environment that reduces intentional risky behavior by employees helps.
It is important to have a balance between people and technology. Risk management should be proactive and ongoing, and it would take trust, transparency, and collaboration for it to work.
The stance here is people first backed by powerful tools will be able to prevent, detect and respond to cyber threats.
Subscribe to get the blog post.
