Introduction
An internal threat is the risk of someone inside a company exploiting a system to cause damage or steal data.
These threats are particularly troubling, as employees are expected to be trusted individuals granted extended privileges, which can easily be abused.
In this lesson, we will learn about:
- Employee sabotage and theft of data and/or physical equipment
- Unauthorised access by employees to secure areas and administration functions
- Weak cybersecurity measures and unsafe practices
- Accidental loss or disclosure of data
Employee Sabotage & Theft
Employees have the privilege of accessing a wide range of physical equipment inside of a company, with only trust to prevent them from damaging or stealing it.
This means that hardware can be physically stolen from the company, or data can be transferred to a USB flash drive and then revealed and duplicated online.
Additionally, employees could purposely damage the business’s equipment or data, such as by deleting the data or smashing a hard drive.
Alternatively, fires, floods, power losses, and even terrorism can occur, destroying equipment and the data it stores.
Some of these are naturally occurring, but they can also be maliciously caused on purpose as part of an attempt to sabotage the business.
Unauthorised Access by Employees
As employees already have access to a company system, they may be able to obtain access to areas of these computers they shouldn’t, such as a colleague who leaves themselves logged in or a room left unlocked, which provides access to a server.
They may also sometimes have, or maliciously obtain, administrative privileges that allow them to perform further administrative functions, such as changing the access rights of other users or deactivating network security tools.
These issues can be a key point for launching further attacks, such as the sabotage and theft we looked at previously or providing access for an external threat to cause harm.
Weak Cyber Security Measures & Unsafe Practices
By not having appropriate digital and physical security, a company increases the chance of a vulnerability being exploited, especially from issues that have arisen previously, like theft.
For example, if a company’s network server(s) is left in an unlocked room, anybody could enter it and damage/steal property. This might be a disgruntled employee or a visitor walking into the business that hasn’t been properly security vetted.
Furthermore, these security vulnerabilities may be accidentally exploited by an ordinary employee who views an untrustworthy website. This could lead to the unintentional download of a virus that could affect the entire network.
What each insider threat means
Match each internal threat to what it means.
Accidental Loss or Disclosure of Data
The same security vulnerabilities that allow malicious behaviour may also permit simple accidents to occur and cause extensive damage.
For example, a person may carry their laptop to and from work. However, they may forget it on the train back home one day.
This means that anybody who gets a hold of the laptop may have access to all the information stored there, potentially exposing important data.
Another example could be an employee accidentally deleting data from a folder or spilling a drink on a device.
Accidental Loss or Disclosure of Data
Some of these accidents can be a result of the limited time invested into properly training and monitoring staff.
Educating staff on how to keep their devices secure and acceptable use of the businesses IT systems, will prevent a wide range of threats.
Furthermore, by monitoring, such as with keyloggers, access logs and remote monitoring software, we can ensure poor practices are not being followed and can identify where the damage occurred.
Which internal threat is it?
Drag each scenario to the type of internal threat it describes.
Lesson Summary
An internal threat is the risk of someone inside a company exploiting a system to cause damage or steal data.
Employees can sabotage or steal company equipment and data, sometimes intentionally or through disasters like fires and floods, posing significant security risks.
Employees can exploit their system access within a company to gain unauthorised entry to restricted areas or obtain administrative privileges, potentially enabling further attacks or external threats.
Inadequate cyber and physical security measures can increase a company’s risk of vulnerabilities being exploited, such as theft or accidental network infections by employees.
Accidental loss or disclosure of data can occur due to security vulnerabilities and simple mistakes and are often exacerbated by inadequate staff training and monitoring.
