For over a decade, the public’s eyes have been glued to the high-profile news of external cyber threats and hacks besieging financial institutions. From infamous ransomware attacks to the large-scale data breaches, our collective focus has almost exclusively been directed outward. However, this is only half of the picture. A substantial share of data breaches involves insiders, whether through carelessness, mistakes or, less often, deliberate misuse. Unfortunately, despite its significance, the peril of insider risks within small, medium, and large financial organisations remains woefully under-addressed.
The Fallacy of Exclusivity
In the labyrinthine corridors of financial institutions, the mainstream conversation about cybersecurity has always been skewed towards external threats. The amount of capital and resources poured into firewalls, intrusion detection systems, and anti-malware solutions is staggering. It is as though these organisations are preparing for a siege while forgetting that some enemies are already inside the castle walls.
Insiders have unparalleled access to sensitive information and critical systems; a negligent team member or, occasionally, a deliberate bad actor can do more harm than any external hacker. Most insider incidents are accidental, which is exactly why they are so often missed. In short, external threats are like thunderstorms that we see and hear, while insider threats are akin to silent, odorless carbon monoxide that poisons us from within.
The Illusion of Complexity
One of the most pernicious myths about managing insider threats is that they are complex and nearly impossible to tackle effectively. The erroneous belief that insider risk is inherently more challenging to resolve than external threats has led to a fatalistic acceptance of its inevitability. In reality, a comprehensive, multi-faceted insider risk program can effectively mitigate these threats.
The Triad: People, Process, and Technology
For an insider risk program to be successful, it must incorporate three pivotal elements: people, process, and technology.
People: The First Line of Defence
Employee training and awareness campaigns must be part and parcel of the risk mitigation strategy. When employees are educated about the potential dangers and the red flags to look for, they become valuable assets in identifying and preventing insider threats.
- Employee Training & Awareness: The most advanced technological solutions are rendered ineffective if the people who use them are not trained properly. Employees should not only be trained on how to use systems securely but also educated on the potential risks that may arise from misuse or negligence. Regular seminars, workshops, and even gamified training can be employed to make sure the staff remains vigilant.
- Behavioural Analytics: Sometimes it’s a subtle change in how data is being handled that signals something is amiss. By paying attention to how sensitive data moves—such as unusually large downloads, or client files being sent to a personal email account or pasted into an AI tool—organisations can pre-empt risks before they become full-fledged threats. The aim is to understand data movement, not to watch people, and staff should know what is in place and why.
- Psychological Safety: A culture that supports open communication allows employees to report irregularities without fear of retribution. In many instances, internal threats are detected by coworkers who observed something amiss but were hesitant to speak up.
Process: The Organisational Framework
Clearly defined protocols for access control, data sharing, and incident reporting can significantly reduce the window of opportunity for insider threats. Rigorous background checks and periodic reviews are also essential.
- Access Control and Privilege Management: Limiting access to sensitive information on a need-to-know basis is fundamental. Role-based access controls can restrict system permissions in line with job responsibilities, thus reducing the risk exposure.
- Insider Risk Reporting Mechanism: A clearly outlined insider risk response plan ensures that once an anomaly is detected, it can be swiftly and adequately addressed. This includes step-by-step guidelines on how to isolate the threat, assess the damage, and inform the relevant stakeholders.
- Audit and Review: Periodic audits and reviews of both system and user activities allow for a retrospective analysis of risk exposure. This enables organisations to fine-tune their security protocols, thus continuously improving their insider risk program.
Technology: The Detection and Alerting System
While technology alone is insufficient, it plays a critical role in detecting and flagging risky activity. Proportionate insider risk detection and advanced algorithms can help in early detection.
- Insider Risk Detection: Insider risk detection solutions can flag unusual activities, such as multiple failed login attempts, unauthorised data access, or irregular data transfers, thus enabling appropriate actions.
- Data Loss Prevention (DLP): These technologies help in detecting and preventing unauthorised data transfers. By establishing what is ‘normal’ within your environment, DLP systems can flag anomalies that may indicate an internal threat. Rule-based DLP struggles with data loss that looks like ordinary, legitimate work, so it is important that any DLP solution is combined with behavioural insider risk detection to be most effective. For organisations on Microsoft 365, ShadowSight’s Data Leakage Prevention adds that behavioural layer on top of Microsoft 365 activity, with every alert validated by analysts before it reaches you.
- AI and Machine Learning: Advanced algorithms can predict risky behaviours by analysing historical data and patterns. By combining AI with behavioural analytics, organisations can add another layer to their defence mechanism.
The Power of Integration
While each of these elements is potent in its own right, it’s their integration that unleashes the full potential of an insider risk program. It is not enough to just install cutting-edge technology solutions or merely conduct staff training; these elements need to be cohesively linked.
Ignoring any of these elements results in a flawed and vulnerable system. People, process, and technology are like the three legs of a stool—remove one, and the entire structure topples. A well-rounded insider risk program that incorporates all three elements not only effectively mitigates risks but also engenders a pervasive culture of information security throughout the organisation. By understanding and integrating these aspects, financial institutions can significantly lessen their vulnerability to insider risks while fostering a more resilient and secure operational environment.
The Perils of a Solely Tech-Centric Approach
Insider risk programs that rely solely on deploying a technology tool are doomed to fail. These tools, while useful for data tracking, cannot replace the nuanced understanding of human behaviour or the protocols required to act on the information. By ignoring the ‘people’ and ‘process’ aspects, these one-dimensional approaches offer a false sense of security.
Elevating Organisational Culture
Perhaps one of the most overlooked benefits of a comprehensive insider risk program is the overall uplift in the organisation’s information security culture. When a financial institution adopts a holistic approach, it is not just preventing leaks and breaches; it is also fostering an environment of shared responsibility and vigilance. In this culture, cybersecurity is not just an IT problem; it’s everyone’s business.
In Summary
Insider threats are the proverbial elephant in the room for financial institutions. The past focus on external threats, while understandable, has left a gaping hole in our defences. However, it’s not too late to change course. Through a well-rounded insider risk program that incorporates people, process, and technology, financial institutions can create a robust and resilient security architecture. Ignoring this pressing issue is not an option; it is high time that insider risks garner the attention, resources, and comprehensive solutions they warrant.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.