Time for Insider-Threat Programs to Grow Up

Immature programs attempting to protect against damaging attacks by insiders run the risk of alienating employees.

The vast majority of companies have embarked on establishing an insider-threat program, but most struggle to create mature processes for detecting and responding to employee-created risk.
In its Insider Threat Report published last year, for example, Crowd Research Partners found that while 86% of organizations had embarked on creating a program, most were still developing the policies and programs, and only a third of all companies considered their insider-threat program to be mature.
The stakes can be high for companies: A badly implemented insider-threat program can alienate employees if they feel their privacy is being compromised by too much monitoring or that management is too quick to suspect workers of foul play. In a research paper published this week, Forrester Research found that many of the current insider-threat programs may violate new privacy laws and the more draconian programs may undercut employee performance, says Joseph Blankenship, vice president of research for Forrester.
If you get the response wrong, and that employee goes out and gets a lawyer, you open yourself up to a world of hurt, he says. So finding the right response and protecting employees privacy are the most important aspect of an insider threat program.
Blankenship sees 2020 as the year that many companies will get insider-threat protection right by focusing not only on risk reduction, but privacy, transparency, and employee experience. While most financial service firms and any company dealing with sensitive data may already have mature processes in place to detect insider abuse, most other companies are not so well-prepared, he says.
2020 will be the year that we take the insider-threat function from ad-hoc to something that is repeatable and improvable, Blankenship says. Many other companies are realizing that they have to provide some rigor around this.
Driven by a rise in inquiries from clients, Forrester conducted the research that formed the basis of
the report
. Different businesses need different approaches to insider threats, he says. A military contractor that faces nation-state actors has a different risk profile and a different insider-threat program than a retailer which has to protect payment card data.
Yet, businesses should not let paranoia undermine their business. While by its very nature an insider-threat program views employees as potential threats, organizations need to work with employees and put them first.
Be Transparent
Transparency is key, according to Forresters report. Organizations need to clearly define their programs and the roles that employees have in helping companies secure their valuable assets. Under the European Unions General Data Protection Regulation (GDPR) and
Californias Consumer Privacy Act (CCPA)
, employees have the right to be informed about how employers are using their information, the right to correct inaccurate information, and the right to be forgotten.
By notifying employees of what information the company collects, and what the purpose of that collection is, the organization educates workers and makes them part of the team. About 82% of companies train employees on ways to minimize cybersecurity risk, according to Crowd Research Partners insider threat report.
In addition to education, companies need to make sure that security programs in general - and an insider-threat program specifically - do not undermine productivity. About 7% of information workers circumvent the policies that companies haave in place for security, often citing a need to do their tasks more efficiently (39%) or the unreasonable restrictions of the security policies (34%), according to Forresters report.
Security people might consider this a human-resources problem, but HR is not the place where it should be housed, he says.
Proper training and using cross-functional teams to establish policy can help. The most important piece is how the company responds to any potentially malicious or damaging behavior, Blankenship says.
Related Content
When Rogue Insiders Go to the Dark Web
1 in 4 Workers Are Aware Of Security Guidelines – but Ignore Them
State of the Cloud

Security Pros Fear Insider Attacks Stem from Cloud Apps
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Poll Results: Maybe Not Burned Out, But Definitely Well Done

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Time for Insider-Threat Programs to Grow Up