In the era of rapid digitalisation, where data is a valuable asset, organisations face an array of threats that could compromise the security of sensitive information. Among these, one of the most pernicious yet frequently overlooked threats is insider risk. It includes malicious or inadvertent actions from employees or contractors that can lead to the exposure or theft of sensitive data, or even disrupt critical business operations. This risk is exacerbated by legislative changes in Australia where companies face significantly increased penalties for privacy breaches, reinforcing the urgency to prioritise robust risk mitigation strategies.
Understanding the Insider Threat Landscape
Insider threats can arise from various sources such as employees, contractors, and even third-party vendors who have authorised access to sensitive data. Often, these individuals have an understanding of the organisation’s security protocols and can, therefore, exploit any vulnerabilities. While some insider threats are deliberate, many stem from negligence or a lack of awareness about cybersecurity best practices. A seemingly innocuous act such as an employee clicking on a phishing link can potentially expose vast amounts of data, causing serious reputational and financial damage.
The Australian Privacy Legislation: Higher Stakes, Higher Penalties
Amid these challenges, companies in Australia are being subjected to more stringent privacy laws. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, in force since December 2022, significantly ramped up the penalties for serious or repeated interferences with privacy. Companies failing to adequately protect customer data now face a maximum penalty of the greater of:
- $50 million,
- Three times the value of any benefit obtained through the contravention, or
- If that benefit can’t be determined, 30% of the company’s adjusted turnover in the relevant period.
In addition, the Australian Information Commissioner has been given stronger enforcement and information-sharing powers, including to assess compliance with the notifiable data breaches scheme and to require entities to publish notices about breaches, thus holding companies accountable for not just their actions but also their inactions in the face of insider threats. The amplified penalties for privacy breaches and the increased powers of the Commissioner reflect a clear message: the cost of a major data breach can no longer be regarded as a mere business expense.
The reforms have continued. The Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, kept these headline penalties for serious interferences with privacy, added lower tiers of civil penalties and infringement notices for less serious breaches, and broadened the Commissioner’s enforcement powers.
Visibility of How Data Moves: A Crucial Element in Mitigating Insider Risk
Given the dangers of insider risk and the increasing penalties for privacy breaches, organisations must prioritise risk mitigation strategies that include visibility into how sensitive data moves. This means using activity the organisation already records, such as in Microsoft 365, to detect unusual or potentially harmful handling of sensitive data, most of which turns out to be accidental. It is not about creating a culture of distrust but about striking a balance between the need to protect sensitive data and respect employees’ privacy.
Insider risk detection can encompass a variety of measures. It may involve utilising advanced analytics to detect patterns that deviate from normal behaviour, such as unusual access to sensitive data or irregular network activities. It may also include training programs to educate employees about the importance of data security and the repercussions of negligence.
Regular reviews of who has access to sensitive data, and how that access is used, can help identify potential risks before they escalate into major issues. Access management protocols, such as ensuring appropriate access levels and enforcing the principle of least privilege (i.e., only granting access necessary for an employee’s role), are also vital to reducing insider risk.
Moving Forward: Striking the Balance
Proportionate insider risk detection, combined with a proactive approach to cybersecurity, can significantly mitigate the dangers of insider risk. However, companies should remain cognisant of the need to balance security measures with respect for individual privacy. Regular communication with employees about what the program looks at and why, coupled with clear policies about acceptable use of company resources, can ensure this balance is maintained.
Australia’s strengthened privacy legislation highlights the growing recognition of data protection in the digital age. It offers a wake-up call to businesses, reminding them that data privacy is no longer just an IT issue but a core business concern. Companies that fail to adopt robust insider risk mitigation strategies, including visibility into how sensitive data moves, risk not only substantial financial penalties but also potentially irreparable damage to their reputation and customer trust.
In Summary
In the face of an evolving threat landscape, maintaining a robust security posture has never been more crucial. The potential dangers posed by insider risk, along with the increased penalties for privacy breaches under Australia’s strengthened privacy legislation, make a compelling case for organisations to prioritise comprehensive risk management strategies. Above all, the commitment to protect sensitive data from breaches must be an integral part of a company’s culture, governance, and operational processes. The stakes are simply too high for complacency.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.