Real damage done by malicious, careless and compromised insiders
A recent OnePoll survey has revealed some surprising results regarding malicious insiders. 36 percent of surveyed companies experienced security incidents involving malicious employees in the past twelve months, and one in fifty employees is believed to be a malicious insider.
According to a recent report from Gartner, “While insider data thefts are often anticipated when employees leave an organization, our research suggests many insiders with bad intentions have no intention of leaving but prefer to turn their access to information into a second income stream.”
Malicious attacks
The surveyed companies provided some revealing examples of the damage that can be done by malicious attacks, including the theft or dissemination of confidential information, identity theft, loss of productivity, and damage to equipment and facilities. Some of the “lowlights” include:
- A company had to shut down for three weeks following an attack against its network.
- Theft and manipulation of records.
- One organisation had its online banking system hacked as a result of a phishing scam.
Careless and compromised insiders
While malicious insiders present a clear security threat, careless and compromised employees can do similar damage, without ever intending to harm the company.
The study showed that 12 percent of companies suffered a security incident as a result of a careless employee, and 21 percent of IT professionals agree or strongly agree that their company is full of “data dummies” – individuals that inappropriately access and misuse enterprise data. Incidents caused by careless and compromised employees included:
- An employee forgot to log out of their computer and someone then accessed the machine and deleted all company files.
- Sharing important confidential documents with the wrong people via email.
- Visiting illicit websites and introducing malware to an organisation’s corporate network.