Ever hear the expression “don’t let the fox guard the henhouse”? The farmer knows his chickens are valuable and puts them in a safe coop with a lock and a roof, protecting them from external threats such as opossums, cats and hawks.

But what is the farmer doing to protect from within the coop? There are measures the farmer has to take — starting with not inviting the fox inside to be the guard!

Watch Out for the Insider Threat

The threats that companies often overlook come from the inside. While outsiders were found to be responsible for 45 percent of the cyberattacks recorded in 2014, 55 percent of attacks were carried out by those who had insider access to organizations’ systems.

Download the white Paper: Get Smart to Shut Down Insider Threats

The insider threat encompasses not only malicious employees who want to do harm, but also compromised corporate IDs and credentials — for example, a user who inadvertently clicks on a suspicious email attachment that exposes the system (and possibly the corporate network) to malware is an insider threat.

Additionally, trusted third-party contractors also count as an insider threat since they have access and entitlements to systems and data that mirror those of direct employees. These can include electricians, construction workers or other repair personnel who come into physical locations or have access to networks. Abusing this type of third-party access demonstrates that attackers can steal third-party credentials and gain access into networks.

Given the complexity of securing sensitive data against internal and external risks, data security is not a one-and-done event; it’s an ongoing process that must be continuously managed, monitored, enhanced and audited across the entire organization. Data security must be deployed as a process that integrates with other security practices (in particular, identity and access management and vulnerability management) as well as other critical business processes.

How to Form the Security Program

Just like the farmer building a safe environment for his chickens, organizations must build strong security programs to defend and protect against new and emerging threats — such as SQL injection, cross-site scripting and privileged insider breaches, just to name a few — based on the best practices for database security and compliance.

A strong security program can help protect organizations from the external and insider threat by helping them:

• Prevent data breaches, insider risk, fraud and unauthorized changes to or the destruction of sensitive data;
• Monitor privileged users such as database administrators, developers, IT administrators, outsourced personnel, etc.;
• Virtually eliminate the overhead and complexity of native DBMS, big data and file system audit logs;
• Automate compliance reporting, vulnerability and configuration assessments and data discovery;
• Encrypt files;
• Mask confidential data in test, training and development systems;
• Redact unstructured data in documents, forms and graphics at rest or dynamically.