In today’s cybercrime landscape, threats come not only from all sides, but also from within. In its annual Threat Intelligence Index, IBM X-Force called 2016 the “year of the mega breach.” As threat actors become more sophisticated, enterprises must deal with outsiders who target corporate networks to steal product, client and customer data. Then there are nefarious or careless insiders who handle data irresponsibly. Chief information security officers (CISOs) must pay appropriate attention to both insider and outsider threats to keep sensitive data safe.

The Insider-Inflicted Data Breach

Sometimes, the greatest threats to corporate data are users with the most privileged access. In early June 2017, a government contractor was arrested for sharing classified materials that she secreted out of her place of employment and mailed to an online publication. This data breach involved not millions of documents, but rather one highly classified national security assessment. As a trusted insider, the contractor leveraged her unfettered access to the information, printed it and simply walked out of the office. This incident illustrated the fragility of our data protection infrastructure.

Data breaches can also result from simple negligence. For example, a financial advisor inadvertently leaked millions of dollars worth of data when he stored client information on an insecure, web-accessible server. In this case, the advisor simply did not have the right tools to determine whether the data was secure.

Another area of concern is targeted phishing emails, which are designed to entice recipients to open malware-laden attachments or links. The X-Force report noted a marked increase in malicious email attachments in 2016, with ransomware accounting for 85 percent. According to Verizon’s “2017 Data Breach Investigations Report (DBIR),” 51 percent of all breaches involving malware and 66 percent of malware installs were caused by malicious email attachments.

These examples further support the need for security leaders to protect company information when employees depart. Their reasons for taking code, data or other information will vary from instance to instance. To combat this threat, the X-Force report advised financial and health care organizations to “focus on educating employees about phishing and how to avoid becoming a victim, use a variety of approaches — video, webinars, in-person instruction — and require training at intervals to make the risk clear.”

An Onslaught of Outsider Attacks

Outsiders come at us from a variety of vectors, including unscrupulous competitors, state-sponsored actors, criminal enterprises and more. The X-Force report highlighted a shift that occurred in 2016 within the world of organized crime and called out the increasing sophistication of external attackers. The extent of the toolkits available to fraudsters is staggering, with 431 million new malware variants emerging between 2013 and 2015.

Cybercriminals have eschewed the mass blast of emails for a more refined approach that allows them to stay under the radar. The need to secure the C-suite is not hyperbole, and all stakeholders within the enterprise must engage in an effective defense strategy. Driving home the importance of locking down company email and evolving processes to protect the email ecosystem is an area that is especially worthy of investment. Smart practices here will help protect the environment from both insider and outsider attacks.

Read the 2017 IBM X-Force Threat Intelligence Index

More from Identity & Access

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today