In today’s cybercrime landscape, threats come not only from all sides, but also from within. In its annual Threat Intelligence Index, IBM X-Force called 2016 the “year of the mega breach.” As threat actors become more sophisticated, enterprises must deal with outsiders who target corporate networks to steal product, client and customer data. Then there are nefarious or careless insiders who handle data irresponsibly. Chief information security officers (CISOs) must pay appropriate attention to both insider and outsider threats to keep sensitive data safe.

The Insider-Inflicted Data Breach

Sometimes, the greatest threats to corporate data are users with the most privileged access. In early June 2017, a government contractor was arrested for sharing classified materials that she secreted out of her place of employment and mailed to an online publication. This data breach involved not millions of documents, but rather one highly classified national security assessment. As a trusted insider, the contractor leveraged her unfettered access to the information, printed it and simply walked out of the office. This incident illustrated the fragility of our data protection infrastructure.

Data breaches can also result from simple negligence. For example, a financial advisor inadvertently leaked millions of dollars worth of data when he stored client information on an insecure, web-accessible server. In this case, the advisor simply did not have the right tools to determine whether the data was secure.

Another area of concern is targeted phishing emails, which are designed to entice recipients to open malware-laden attachments or links. The X-Force report noted a marked increase in malicious email attachments in 2016, with ransomware accounting for 85 percent. According to Verizon’s “2017 Data Breach Investigations Report (DBIR),” 51 percent of all breaches involving malware and 66 percent of malware installs were caused by malicious email attachments.

These examples further support the need for security leaders to protect company information when employees depart. Their reasons for taking code, data or other information will vary from instance to instance. To combat this threat, the X-Force report advised financial and health care organizations to “focus on educating employees about phishing and how to avoid becoming a victim, use a variety of approaches — video, webinars, in-person instruction — and require training at intervals to make the risk clear.”

An Onslaught of Outsider Attacks

Outsiders come at us from a variety of vectors, including unscrupulous competitors, state-sponsored actors, criminal enterprises and more. The X-Force report highlighted a shift that occurred in 2016 within the world of organized crime and called out the increasing sophistication of external attackers. The extent of the toolkits available to fraudsters is staggering, with 431 million new malware variants emerging between 2013 and 2015.

Cybercriminals have eschewed the mass blast of emails for a more refined approach that allows them to stay under the radar. The need to secure the C-suite is not hyperbole, and all stakeholders within the enterprise must engage in an effective defense strategy. Driving home the importance of locking down company email and evolving processes to protect the email ecosystem is an area that is especially worthy of investment. Smart practices here will help protect the environment from both insider and outsider attacks.

Read the 2017 IBM X-Force Threat Intelligence Index

More from Identity & Access

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today