A new lawsuit alleges this consultant stole a library of data from his former employer - copying it from cloud storage to a USB drive - to start a competing firm.

Having a Digital Rights Management tool can help your team collaborate in the cloud while meeting compliance needs and adhering to your organization's data security policies.

Learn about VPNs, why organizations are using them so much more, and what IT leaders can do to help ensure their security.

No one wants to think they have an employee or third party that is an insider threat, but mitigating these risks before they turn into complete attacks is key. What Is an Insider Threat? An insider threat is a malicious or negligent individual that is a security risk because they have access to internal information and can misuse this access. External actors aren’t the only ones who pose risks to an organization’s cybersecurity. An insider threat is a peculiar security risk that originates from within the company, either deliberately or due to human error and carelessness. Hence, the insider threat poses the conundrum that an organization’s biggest assets can also be a source of risk. What makes insider threats dangerous is the fact it is perpetrated by someone who has a relatively intimate knowledge of the company’s operations and therefore knows the lay of the land. According to the 2022 Ponemon Cost of Insider Threats Global Report, insider threats have grown by 44% in the past two years alone. In addition, its cost per incident has ballooned up to $15.38 million, now a third of the previous amount. Who or What Is an Insider? As its name implies, insider threats arise from users who have legitimate access to an organization’s resources. This often includes information, equipment devices, personnel facilities, network, and system access. Most often than not, this person is usually an employee, but they can also be a third-party contractor or vendor. In short, anyone who works directly with an organization can pose the risk of being an insider threat. The following are some examples of insiders: An individual who has been provided with a badge or access device like a contractor, vendor, or partner. An individual in who an organization has placed an implicit amount of trust in, with privileged access to varying degrees of sensitive information. An individual a company has provided some sort of computer and/or network access to. Terminated or resigned employees who still have credentials or enabled profiles. High-privilege users like programmers and software developers with access to data through a staging area or development environment. A vendor or contractor who has some type of exclusive knowledge about an organization’s operations, fundamentals, business strategy, and goals either through providing products, services, or having privileged access to their secrets. A government official or someone working for the government who has access to classified information that has national security implications if compromised. Types of Insider Threats Insider threats can come from anyone and from any level of the organization. However, those who perpetrate it successfully often have high-privilege access to data. Insider threats can be divided into two categories based on the intent: those that pose a risk unwittingly and those intentionally being malicious. 1. The careless insider: This activity borders on negligence when the insider unwittingly exposes the organization to outsider threats. These are often the result of unintentional mistakes, the most common of which are falling for phishing attacks or scams that infect the system with malware.Others include leaving misconfigured databases, poor administrative credentials, and improperly disposing of sensitive company documents. The pawn: These are the unknowing group of insiders that have been manipulated and deceived to harm the organization. They are individuals who fall prey to social engineering or email spear-phishing attacks that make them give up their login credentials or click on harmful links that download malicious payloads. The goof: These are insiders who put companies at risk due to their frivolity born out of incompetence, ignorance, or carelessness. 2. The mole: This individual is an imposter who nefariously gains insider status. This person might pose as a vendor, partner, or employee to gain privileged access to the company’s network or premises. 3. The malicious insider: Malicious insiders are the most dangerous category of insider threats. These are often employees, but they can also be contractors, vendors, or partners. They intentionally try to harm their organization by abusing their position either through malicious exploitation, stealing information, misusing data, abusing credentials, destroying data, and/or compromising networks. The collaborator: A subset of the malicious insider is the person who collaborates with outsiders to commit an insider crime. They can partner with their company’s competitors, organized crime groups, or even nation-states. The objective could be to steal customer information, personally identifiable information, trade secrets, business operations, and intellectual property. The lone wolf: These are independent actors who aren’t actively influenced, supported, or controlled by any external parties. These categories of malicious actors are usually dangerous because they are often highly motivated and singularly driven in the pursuit of their goal(s). Because they are confident they can pull off their nefarious acts alone; they are individuals who often have elevated privileges and high levels of access, such as systems administrators. Why Insider Threats Occur Most of the time, employees don’t join organizations with the intent to inflict harm on their company. Over time, greed and/or the accumulation of personal grievances, with the desire for revenge, eventually turn some individuals into malicious actors within an organization. The vendetta of intentional threats is manifested in various ways such as sabotage, espionage, corruption, and theft; and they are most often expressed in hostile cyber acts. Moreover, a combination of factors has equally heightened the propensity for insider threats to occur. Among these is the increased relevance of information-sharing and distribution of sensitive information, which provides disparate individuals with greater access to critical data. Insider threats are often surreptitious and not immediately detectable. They can even go on for years because they are notoriously difficult to uncover. For instance, the Canadian finance company, Desjardins Group had to settle a class-action lawsuit for $201 million. This was because a malicious insider capitalized on the seemingly benign but foolish company process of copying customer data to a shared drive so everyone could use it. The insider copied the data for over two years without detection until 9.7 million records were publicly disclosed. How Can I Detect Malicious Insiders? There are no foolproof ways to detect who has the potential of becoming an insider threat to your organization. But insider threat prevention requires marshaling resources to detect the elements that indicate an insider threat is likely imminent or possible. People as Sensors People are the first line of defense, especially in the identification and detection of potential insider threats in their fellow colleagues. Employees are more prone to carry out attacks against their employers when they are under a series of stressors. This pressure and stress can make them careless on the job and even grow to become disgruntled employees. Thus, they became prime targets and vulnerable to criminals and foreign agents. Therefore, it would behoove employers to be on the alert for employees or insiders who exhibit certain concerning behaviors. Detecting and addressing these concerning behaviors early, then providing help, can make the difference between a loyal employee and an insider that commits a harmful act. Monitoring Insider Activity In addition to human observation and sensors, technology can also be used to detect vulnerabilities in the system that indicate the potential presence of an insider threat. For instance, if an employee seeks access to documents that have nothing to do with their job function or roles, then the system should be able to flag such activity. Insider Steps Toward Malicious Activity Stress may be a contributing factor to an insider threat, but it’s disingenuous to blame it alone for destructive and disruptive acts of sabotage. Those who study insider threats emphasize that its rarely spontaneous, but rather an evolution that moves through several critical pathways:

HelpSystems' new Director of Product Management, Data Protection, Wade Barisoff, gives his first impressions of RSA Conference 2022.

Learn about the CIA Triad and why it can be a helpful model to guide policies for information security within an organization.

Data analyzed this week highlights the percentage of data breaches carried out by insiders at law firms in the U.K.

A new cybersecurity alert is encouraging organizations to strengthen weak security controls commonly used by attackers to gain access to systems.

The findings come courtesy a new investigation via The British Medical Journal (BMJ).

What Is Document Security? Document security is the procedures and storage protocols set up to protect either a physical or digital document which includes how it will be stored, shared, and discarded. This security is important so the owner can control who has access. Document security seeks to protect documents and comply with regulatory requirements for privacy and safety. It involves a file management process to restrict access, especially to sensitive or private content. File security entails managing these files securely however they are stored, processed, or transmitted to mitigate security threats. Why Is Document Security Important? Documents face a myriad of threats from many malicious actors. Thieves, cybercriminals, and organized crime syndicates want to steal identification details to gain access to financial gateways like bank account logins and credit card information. Confidential data provided to businesses by their customers and employees needs to be kept under tight privacy protocols. Businesses risk lawsuits and reputational damage if this information is compromised. Intellectual property is a competitive advantage on which the prosperity of companies and nations depends in an increasingly global marketplace. Therefore, organizations don’t want their business secrets and intellectual property to fall into the hands of competitors through espionage. All this valuable and sensitive information is invariably stored in digital documents. Document security seeks to prevent these incidents by protecting files from unauthorized access and reducing the risk of data loss, leakage, and exposure. Types of Document Security Different documents require different levels of protection. Overall, the type of security documents require are the five pillars of information assurance: Confidentiality: Confidentiality means the information in the file remains private. The secrecy required to shield the file’s content from those who aren’t authorized to view it is enforced with encryption. Integrity: Integrity ensures a file hasn’t been inadvertently or intentionally modified, whether at rest or during transmission. Hash functions use a hash value to verify the integrity of the data within the document. Availability: Adequate security measures ensure documents are available to authorized users when needed. This means that threats, like denial-of-service attacks, have to be thwarted to ensure documents on websites are available to those who need to access them. Authentication: Authentication compels those who attempt to access documents to prove that they are who they say they are. This requires robust identity management. Most organizations now implement multi-factor authentication to strengthen authentication. Nonrepudiation: This ensures that the parties involved in a transaction cannot deny their participation. Hence, a security system should be able to prove that someone sent, viewed, or modified a file. Nonrepudiation is achieved through digital signatures, logging, and audit trails. Components of Document Security A document protection system contains several components that facilitate its mission to protect documents. Some of these help to restrict access to only authorized users, while other components control permissions on who can modify a file. Here are the security components typically used in these security systems: Encryption and license controls: Encryption uses cryptographic algorithms and keys to scramble or encrypt a file’s content so that it becomes unreadable. Hence, only valid users and recipients, who possess the correct cryptographic key, can decrypt and view the file’s contents. Document rights management: DRM is a perimeter-based security model that seeks to protect documents and content from copyright infringements and intellectual property violations. Its objective is to restrict the access of digital content to only those who have assumed rightful ownership, typically through purchase or authorship. Document tracking: For a document to be truly protected, both within and outside the corporate perimeter, a business needs to have full visibility into its movement and chain of custody. One of the ways this visibility is achieved is through tracking the document to know who has accessed and viewed it and for how long these transactions have occurred. Password protection: From a user access perspective, enabling password protection is the first step in document protection. It is the first security barrier to prevent unauthorized access to files. Moreover, it is relatively simple to implement, although not entirely foolproof. Document expiry, restriction of access, and self-destruction: Limiting access to documents based on time duration and permissions provides immense advantages for security. Watermarking: Watermarking has several applications beyond the use as a trademarking device. One of its basic functions is to clearly communicate the document’s classification. Hence, it leaves the recipients with little doubt as to how the document should be treated. A document marked with a “confidential” watermark signals a certain degree of secrecy. Information rights management: Information rights management is a subset of DRM and it focuses on zero-trust security for collaborative files. Information Rights Management security travels with the document wherever it goes, equipped with identity access management techniques to ensure user permissions are enforced. Implementing Document Security at Each Stage of the Document Life Cycle There are several phases involved in document protection. At each stage of a file’s life cycle, organizations face the danger of the document being stolen, lost, or compromised. Therefore, businesses need to have full visibility into how their documents are produced, processed, stored, and consumed—i.e., throughout the entire document life cycle: 1. The Capture Phase This is the equivalent of the “onboarding” of information to produce the document. This phase encompasses creating and saving files in an application. Activities at this stage also include scanning to transfer hard copy documents to electronic format. 2. The Storage Phase Electronic-based document storage provides a lot of opportunities for centralized record management and better oversight. For instance, storage in database systems provides the capacity for search capabilities and normalization to reduce redundancy. 3. The Management Phase One of the most important things for file protection, especially in a distributed system is adequate management. Management helps to provide supervision and control over the document protection system. What facilitates security during this phase are user roles, permissions, version control, and audit trails. These elements have a way of reinforcing one another to provide all-around document protection management. Ultimately, without this phase of a document security system, elements like user permissions will be difficult to enforce. 4. The Preserve Phase Document preservation requires monitoring and maintenance of the digital repositories where they are stored. In most cases, file retention is required by law. And in some instances, documents are legally required to be preserved for a couple of years. 5. The Delivery Phase The delivery phase emphasizes sharing and collaboration. The delivery phase is important when it’s necessary to share information between contractors, allies, and other business partners. 6. The Integration Phase In the current digital economy, it’s imperative for applications and documents to be able to “play well” and collaborate with others. This is because there’s a certain specialization of roles and division of labor since a single application can’t supply all the expertise needed to support user aspirations. This is why there’s a proliferation of application program interfaces in software to facilitate integration between applications. Likewise, the integration phase allows files to communicate and exchange information with other applications. Document Security Measures That Every Business Needs Remote work and "bring your own device" have increasingly become part of the fabric of the modern workforce. Along with these paradigm shifts come more security risks because of an organization’s increased surface of attack exposure, thereby making their documents more vulnerable. Here are some of the security measures organizations can implement to address the challenge of workforce mobility: 1. Intrusion Detection Systems Malicious actors are using more sophisticated attack vectors that can operate in stealth mode. Most businesses don’t have a clue they have been breached, sometimes even months after the fact. Therefore, an added layer of document protection is justified by investing in an intrusion detection system to monitor your network. These systems alert you to suspicious behavior that is indicative of a system breach.

New numbers claim there was a 65% increase in identified global exposed losses connected to BEC scams from 2019 to 2021.

We look at six data security risks that can jeopardize your organization's continued growth.

The company claims a stealth startup has poached 40 of its former employees, who in turn have stolen designs on its tech.

Learn more about what DFARS compliance means, who and what it applies to, and what the minimum requirements are for organizations to comply.

Learn about digital rights management and why it is important in Data Protection 101, our series on the fundamentals of information security.

The ransomware-as-a-service group has been on a tear, compromising hospitals and healthcare facilities, since June 2021.

Intellectual property theft involves stealing information, trademarks, inventions, ideas, copyrights, patents, and other intellectual property from a person or company and then, usually, using them for their own gain.

The program hopes to get agencies on the same page when it comes to implementing security and resilience practices when utilizing cloud services.