How do I prevent a malicious insider threat?

1:3 data breaches are due to malicious trusted insiders.

90% of senior managers are worried about the insider threat.

A malicious insider’s system access and knowledge of business processes can make them hard to detect. But there are practices you can put in place to reduce the risk of a malicious insider in your organisation.

Business processes: Personnel security (PERSEC)

For all employees, irrespective of their system access, pre-employment and background checks are a good first step. Be clear with new starters on how you can and will check their background and suitability to have access to PII or commercially sensitive information. You should also consider ongoing, periodic checks to ensure that you employees’ situations haven’t changed to enhance your organisations security posture, culture and overall contentment of your staff. These steps will help mitigate the insider threat. The more integrity and transparency you have in your work environment, the harder it is to act dishonestly. Additionally, happy, valued and challenged staff members are less likely to act to harm your organisation.

Thinking of selling your business?

Then know that a data breach in your recent past degrades your intangible assets – goodwill and reputation – by as much as 20% from a like-for-like company that has not had a breach. You can enhance your business’s valuation and reputation by having your staff’s background reviewed.

Need a threat assessment or cyber audit?

Avantia Corporate Services is a specialised business consulting practice that focuses on cyber security risk assessments and mitigation & resilience.

Data Privacy Insurance Cyber Data-Risk Managers Pty Ltd is an insurance broker based in Melbourne, Australia specializing in Cyber insurance / Data breach insurance.

Cyber Indemnity Solutions CIS provides data protection products and services by combining cybersecurity with data/cyber insurance for business including SME/SMBs, building a deep cyber defence strategy.

Information Integrity Solutions Pty Ltd. (IIS) helps public and private sector organisations embed trust, privacy and security as core value propositions internally and in their products and services.

Proofpoint and ObserveIT protects your people, data and brand against advanced threats and compliance risks.

CommsNet Group Pty Ltd delivers practical, street smart lessons on how you can effectively identify and mitigate against internal threats.

One Dot Zero One Dot Zero specialises in providing cyber security services tailored to suit your company’s specific needs.

Are you a Cyber security auditor?

If you provide a whole-of-business perspective audit – not just pen testing (for example) or Top 4 or Essential 8 examinations – you can now report on ways to protect your client against malicious insiders because you are in the unique position to understand the organisation, IT systems, culture and business processes. By assessing the enterprise’s personnel to understand any underlying potential security risk or vulnerabilities on the risk surface you can provide specific immediate remediation advice and offer recommendations and pathways to establish a strong cyber employee posture and better cyber hygiene going forward.

The ACSC encourages all organisations to implement a range of measures, both policy and technical, to increase their cyber security. Personnel management is a key part of cyber security, which is recognised as a key part of the ACSC’s Cyber Security Principles (see https://www.cyber.gov.au/acsc/view-all-content/guidance/cyber-security-principles).

ISM P10: Only trusted and vetted personnel are granted access to systems, applications and data repositories.

Wherever stage you are at in your cyber maturity, you can move to the next level:

1. Incomplete: The cyber security principles are either partially implemented or not implemented.
2. Initial: The cyber security principles are implemented, but in a poor or ad hoc manner.
3. Developing: The cyber security principles are sufficiently implemented, but on a project-by-project basis.
4. Managing: The cyber security principles are established as standard business practices and robustly implemented throughout the organisation.
5. Optimising: A deliberate focus on optimisation and continual improvement exists for the implementation of the cyber security principles throughout the organisation.

Talk to us about how Cleard Life can assist your situation.

Contact Cleard Life today. Call 02-6171-4171 or sales@cleard.life or join now for your free Suitability Assessment (valued at $169).

Additional resources: