Employees are often cited as one of the top reasons data loss occurs. Whether negligent or malicious, insiders, with high levels of physical and digital access to sensitive information, have the power to inflict the most damage to a company’s data security. According to the IBM X-Force Threat Intelligence Index 2017, negligence accounts for up to 53% of all cyberattacks businesses suffer, depending on the industry sector, while malicious insiders only for up to 25%. However, ill-intent, because it intentionally targets valuable information, is the biggest danger a company faces from the inside. Therefore, it is well worth keeping an eye on disgruntled employees.
Warning signs include virulent disagreements with management or company policies, poor evaluations that might spark discontent and transition to other places of employment. Companies often see a spike in sensitive data activity before employees quit. Unusual working hours can be an indicator an employee is looking to access data when others are not present to discover and report his activities to the management. A change in their financial situation, for better or for worse, should also be investigated as it can mean an employee might be tempted to or is already selling sensitive data to earn extra money.
If data protection in the company is lax, employees, especially long-term ones, already know a system’s vulnerabilities and what they can and cannot do with sensitive data. Copying files onto USB devices, emailing confidential information from a work place computer to a personal email or via a popular information sharing platform like Dropbox or Google Drive can be very easy without the right Data Loss Prevention tools in place.
Solutions such as Endpoint Protector, enforced through company policies, can block the transfer of predefined sensitive data sets based on name, type, content or compliance profiles for regulations such as HIPAA, GDPR, GLBA, PCI and others whether to removable devices or online sharing services. Through eDiscovery, these files can be scanned for on employee computers and deleted or encrypted when found. You can even go a step further with MDM and block camera, Bluetooth and WiFi options on BYOD when devices are on company premises.
Remote working can also offer many data theft opportunities not only through the loss or unlawful appropriation of physical devices, but also the possibility of sharing passwords, encryption keys and company laptops with unknown third parties in an uncontrolled environment. After all, while we can make data secure in a digital environment, it is hard to account for outside factors. Taking pictures or writing down sensitive data can be easy workarounds to the most sophisticated Data Loss Prevention tools. Like any security software, DLP is not a bulletproof solution.
Ultimately, human ill-intent is one of the most serious risks a company’s data faces. Outside threats can be guarded against and negligence improved through awareness and Data Loss Prevention tools, but when malice comes under the guise of a trusted user within your own network, it is hard to predict and avoid. It is therefore important that companies do not neglect the human element in a company’s digital system. It is important to see red flags when they flare up before you find yourself facing data theft or breaches for profit or revenge.
Download our free ebook on
Data Loss Prevention Best Practices
Helping IT Managers, IT Administrators and data security staff understand the concept and purpose of DLP and how to easily implement it.
