Any horror movie junkie will tell you, if the protagonist gets a creepy phone call, it’s probably coming from inside the house. That same logic can be applied to cybersecurity and insider threats — especially now that more than half of US employees are working remotely. In fact, insider threats increased by 25 percent last year, thanks in large part to remote work.
Insider threats are largely misunderstood, yet their costs to organizations can be just as high as attacks by cybercriminals. And while breaches by insiders are most often the result of well-intentioned negligence, remote work has further complicated (and diluted) office security, leading to an increase in the use of shadow IT. Of course, we can’t forget that deliberate, malicious sabotage by insiders, though less common, is also made that much easier by remote work.
Remote work a boon for insider threats
As of today, more than half of the American workforce is working remotely “always” or “sometimes,” according to a February 2021 Gallup. More than a year into the pandemic and remote work is holding strong — and so are insider threats.
In fact, insider threats have risen sharply over the last three years in volume and cost. The 2020 Cost of Insider Threats Report by Ponemon Institute found that malicious insider threats increased by 47 percent from 2018 to 2020. In addition, the cost of those threats surged 31 percent over the same period, from $8.76 million to $11.45 million. Of all industries, retail and finance experienced the most growth in insider threats over the two-year period.
But a rise in remote work is adding fuel to the fire, leading to an even greater increase in insider threats through the pandemic and beyond. Forrester found in its Predictions 2021: Cybersecurity report that breaches caused by employees increased by 25 percent in 2020, thanks in large part to remote work.
So why does remote work cause insider threats?
Insider threats were far less threatening before the rise of remote work. Before the pandemic, a minority of organizations’ employees worked remotely, so security policies were lax. (As were the security habits of remote workers.) A lack of physical oversight made it difficult to enforce stronger policies or even to push out updates. Weakened traditional office security infrastructure, going from brick-and-mortar to virtual, also allowed for more mistakes by employees and more opportunities for malicious actors.
Malwarebytes Labs’ 2020 report on Covid’s impact to business security found that 20 percent of organizations experienced a breach because of a remote worker. Pandemic conditions often led to hastily thrown-together remote infrastructures built by potentially outstretched, overworked, or underfunded IT/security teams. Work from home (wfh) user behavior also led to mistakes, resulting in security breaches. That behavior has only been exacerbated the longer the pandemic has stretched on.
Margaret Cunningham, principal research scientist of Forcepoint X-Labs, recently conducted a survey of 2000 European workers’ wfh behaviors to determine why insider threats happen. She found that while younger workers reported a much higher use of shadow IT than older workers, an average of 50 percent were using some sort of shadow IT. That’s a lot of people and a lot of different exposure points for organizations’ assets and data.
The survey found that mistakes were made by users because of:
- increased stress (especially for caretakers, such as parents or those caring for a sick or disabled family member)
- blending of personal and professional boundaries
- lots of distractions
- well-intentioned innovation or creative problem-solving
This last one is interesting and may be a harbinger of increased insider threats to come. An employee may be working on something potentially innovative or creative to get their job done, but in doing that, they create security issues.
All of this well-intentioned behavior doesn’t mean the entire US workforce is benevolent. While the majority of insider threats are honest mistakes, there are still plenty of malicious insiders. Ponemon’s 2020 Insider Threats Report also found that 23 percent of insider threats are deliberate, malicious acts.
Case in point: In Q4 2020, Shopify was breached in an insider incident. The customer data of about 200 merchants was exposed by two employees who were scheming to steal transaction data. The data exposed included details like email, name, street address, and order details, but didn’t involve complete payment card numbers or financial information.
While malicious insider threats are less common, they are more costly than those made by careless mistakes. Ponemon found that careless or negligent employees cost organizations an average of $307,111 per incident, and malicious insiders or credential thieves cost $871,686. The cost of insider incidents on the whole has surged by 31 percent over the last two years.
So what can organizations do to mitigate these risks? What’s NOT going to work is making it even harder to do work because of stringent security policies. We need to think more about what people are doing and why.
Cunningham’s survey showed that the sense of being burdened by security policies mirrors the use of shadow IT: It’s parallel. We may need to loosen our guard in one area — allow some low-risk security faux paus — in order to shore up the other. Security and IT teams should also be more communicative about why they’re blocking access or what’s at risk.
For more information on risk mitigation for insider threats, check out this article on building a secure, cloud-based remote workforce: https://blog.malwarebytes.com/business-2/2020/03/remotesec-achieving-on-prem-security-levels-with-cloud-based-remote-teams/
For a refresher on best wfh security practices, consider sending your employees this article: https://blog.malwarebytes.com/how-tos-2/2020/03/security-tips-for-working-from-home-wfh/
Here’s a video interview of Margaret Cunningham discussing the factors that influence remote worker behavior: https://www.bankinfosecurity.com/remote-work-creates-insider-threat-concerns-a-16240