As increasing number of data breaches and ransomware attacks are taking place, regulators continue to warn healthcare institutions and third-party vendors not to belittle the grievous security and privacy hazards that insiders can create.
The Department Of Health And Human Services Office For Civil Rights recently released a cyber awareness alert to urge organisations to closely assess the dangers their employees may cause.
Image source: Pixabay
According to the alert, one of the largest threats to any organisation is insider threat, and most cyber-attacks are usually insider driven. Here it must be noted that not all insider threats are malevolent or deliberate, but the outcome of these hazards can be detrimental to any organisation or business associate and is likely to have a counterproductive repercussions on the privacy, integrity and accessibility of electronically secured data.
A number of cases have reported that the main miscreants of data breaches have been insiders. The causes of those data breaches ranged from staffing errors, such as unintentionally opening an email containing malware and virus or deceived by hackers’ tricks that cause privileged users turning in their private identification information to cyber criminals; as well as deliberate malicious intent theft of a breach of trust with fraudulent intent, that involve staffers engaging in identity felony, forgery and other criminal activities. In a unique case involving an insider, a former therapist in Oregon, Ohio was convicted of unethically acquiring health data of over 500 patients. According to prosecutors, the former therapist used the data for attempting, securing or using intravenous drugs.
With data breaches and ransomware dominating most of the headlines for data security, the dangers posed by insiders has been greatly overlooked, according to analysts and security consultants. A number of organisations and senior management tend to ignore or do not comprehend the outcome of insider threats. Organisations must understand the hazards that insiders face to the security of their protected data; keeping that threat in mind, it is imperative that relevant resources are allotted to amply deal with those risks.
Image source: Pixabay
A recent survey revealed that over 75% of organisations have experienced some form of an insider threat of success at reaching data and other similarly related data corruption. Some of the most common insider incidents involving malicious and intentional reasons include unauthorised access to steal important data, exposing sensitive or classified information, deliberate installation of malware, malicious code and similar such viruses and stealing of intellectual property.
Some important steps that organisations must take to prevent and detect data theft involving insiders include: limiting functions and authorisations more attentively; positioning internal observation; enforcing data loss prevention resolutions; and supervising staffer conduct, not just compliance. In addition, it is also very critical that organizations protect prospective employees to ascertain if they are authentic and suitable for the purpose for which they are being considered.
Moreover, organisations as well as their affiliated vendors and associates would be able to better manage insider threat by investing in the right data protection tools and also commit to genuine audit approaches and behavioural modeling.
Comments are closed, but trackbacks and pingbacks are open.