{"id":253647,"date":"2024-05-28T11:39:34","date_gmt":"2024-05-28T11:39:34","guid":{"rendered":"https:\/\/aijourn.com\/?p=253647"},"modified":"2024-05-28T13:44:32","modified_gmt":"2024-05-28T13:44:32","slug":"keep-your-friends-close-and-your-employees-closer-the-rise-of-insider-threats","status":"publish","type":"post","link":"https:\/\/aijourn.com\/keep-your-friends-close-and-your-employees-closer-the-rise-of-insider-threats\/","title":{"rendered":"Keep your friends close and your employees closer: the rise of insider threats"},"content":{"rendered":"\n

According to a report by Intrusion<\/a>, cybercrime will cost companies worldwide an estimated $10.5 trillion annually by 2025, up from $3 trillion in 2015. To put this into perspective, this is over double the revenue generated by the oil and gas industry, which generates approximately \u00a35.3 trillion<\/a> annually.<\/p>\n\n\n\n

At a growth rate of 15 percent year on year, cybercrime is already one of the most profitable illegal occupations in the world, outstripping even the global drug trade. In fact, according to Intrusion\u2019s research, cybercrime represents the greatest transfer of economic wealth in history.<\/p>\n\n\n\n

For such reasons, Intrusion CEO, Jack Blount, views cybercrime as one of the most significant threats to present day business operations and economic prosperity.<\/p>\n\n\n\n

\n

“Cybercriminals know they can hold businesses \u2014 and our economy \u2014 hostage through breaches, ransomware, denial of service attacks and more. This is cyberwarfare, and we need to shift our mindset around cybersecurity in order to protect against it.”<\/p>\nJack Blount, President and CEO at Intrusion, Inc.<\/cite><\/blockquote>\n\n\n\n

But while this notion of cyberwarfare can certainly help us to take cybersecurity more seriously, it also cultivates the misleading perception that cybercrime is a black-and-white, good guys vs bad guys type situation, when a deeper look tells us otherwise. Recent research published in Cyber Security Magazine<\/a> from IT hardware company, Apricorn, indicates that up to 70% of data breaches can be traced back to the actions of employees, i.e. result from insider threats.<\/p>\n\n\n\n

Other findings further support the conclusion that insider threats are on the rise, with Verizon\u2019s 2024 Data Breach Investigations Report (DBIR<\/a>) finding that 76% of data breaches involved insiders in 2023, up from 74% in 2022. Along similar lines, Splunk\u2019s 2024 State of Security Report<\/a> found that 42% of security leaders are experiencing insider attacks with increasing frequency.<\/p>\n\n\n\n

Insider threats can be malicious and intentional, or accidental. Either way, they can cost a company a huge amount, even leading to liquidation in some cases.<\/p>\n\n\n\n

Reassuringly, the majority of insider threats are attributed to accidental mistakes made by employees. According to Verizon\u2019s research in the DBIR, malicious insiders accounted for only 8% of data breaches. The remaining 68% of breaches involving insiders were unintentional and due to accidents or negligence.<\/p>\n\n\n\n

Nevertheless, malicious insider attacks might be on the rise, with Apricorn\u2019s research finding that of the 200 IT decision makers they surveyed, 20% cited intentional\/malicious insider threats as the main cause of a data breach and only a minimally more 22% who cited unintentional\/accidental insider risk as the main threat.<\/p>\n\n\n\n

While malicious insider attacks still account for just a minority of overall cyberattacks, they can be some of the most dangerous and vicious attacks, given that employees have insider knowledge of their company\u2019s operations and greater access to their data. This means that they have the potential to exploit the company\u2019s lesser known vulnerabilities and really hit them where it hurts.<\/p>\n\n\n\n

Below, we look at the key appeals and motivations behind cybercrime in order to help businesses better understand and guard against malicious insider threats.<\/p>\n\n\n\n

Common motivations<\/h2>\n\n\n\n

The motives of cybercriminals do not fall under a neat bracket. The occupation is an opportunistic one, with the potential payoff varying according to factors related to specifics of the company targeted and the data that is successfully extracted. Nevertheless, most cyberattacks have a financial component to them, with leaked data often being used as a leveraging tool for blackmail and extortion.<\/p>\n\n\n\n

Nevertheless, besides the rich financial rewards of a juicy payoff, there are several other potential draws to the occupation.<\/p>\n\n\n\n

    \n
  1. Cyber intelligence is now at the forefront of most important business operations. Cybercrime thus has significant appeal for individuals and groups who may have political or ideological agendas, and wish to impact society by sabotaging businesses and organisations in an anonymous and underhanded way. This motivation is commonly referred to as hacktivism<\/a>, and would likely only be a motive for insider threats in cases where an employee was significantly opposed to the actions of their company or the direction it was going in.<\/li>\n\n\n\n
  2. Cybercrime is really all about leveraging power through withholding or leaking data. This means that it may hold appeal for individuals who are seeking a level of control and power over an organisation that is beyond the realistic ambitions they might have for internal promotion and recognition. Personal vendettas, harboured resentments, and individual relationships can play into this motivation \u2013 research by Gallup<\/a> finds that employees who feel that their manager is invested in their strengths are three times more likely to be loyal to the company.<\/li>\n\n\n\n
  3. Cybercrime has the potential to expose or steal a business\u2019 IP, proprietary information, and trade secrets. Thus, it plays a key role in corporate espionage, particularly in public sector industries where the data at stake is more likely to be highly confidential and may in some cases have broader international implications. Therefore, employees with significant external affiliations and loyalties may engage in cybercrime for this reason.<\/li>\n<\/ol>\n\n\n\n

    Splunk Security Strategist, Audra Streetman, shares further perspective on some of the factors and situations that could give rise to malicious insider attacks.<\/p>\n\n\n\n

    \n

    \u201cThere are several reasons why an employee might act intentionally or unintentionally as an insider threat. Intentional insiders may harbour personal grievances due to, e.g., being passed up for a promotion or other perceived slights. You could alternately speculate that an individual might be most inclined to harm the organisation when facing reprimand, demotion or termination. This could result in sabotage targeting an organisation\u2019s physical or IT infrastructure. Malicious insider threats may also act for personal benefit, such as exfiltrating banking data for financial gain or even colluding with someone outside of the company to facilitate fraud or intellectual property theft. This is often accomplished through privilege misuse and in some cases, employees may be acting as a spy for outside governments.\u201d<\/p>\nAudra Streetman, Security Strategist at Splunk SURGe<\/cite><\/blockquote>\n\n\n\n

    Previous cases of cybercriminals who have been caught indicate that these factors are big motivators of cybercriminal activity. This is clear to see in a Lawfare article<\/a> written by Mark Vantanyan, which details the personal motivations of various individuals who were caught for cybercrime back in 2017. In particular, one of the case studies in this article highlights how an individual\u2019s inclination towards cybercrime stemmed from a desire to prove their worth. This motive was then further accelerated by recruitment initiatives from hacking collectives.<\/p>\n\n\n\n

    As this case demonstrates, the motivations for cybercrime are likely to consist of multiple, interrelated factors. While recruitment initiatives from hacking groups are on the rise, this doesn\u2019t necessarily mean that employees are more likely to take the bait, as Streetman additionally pointed out. <\/p>\n\n\n\n

    Nevertheless, it does mean that employees who already have some motivation for and inclination towards cybercrime might be more likely to actually go through with it. This is likely particularly the case for individuals who are motivated by recognition for their talents and feel undervalued within their company.<\/p>\n\n\n\n

    Stereotyping the cybercriminal<\/h2>\n\n\n\n

    Stereotyping people can take us down dangerous and misleading paths. However, there are certain cases where stereotyping can help us identify and better understand a set of individuals whom we otherwise have little way of identifying.<\/p>\n\n\n\n

    In a LinkedIn article<\/a>, cybercrime lawyer Bhagat Singh Sharma attempts to unearth the psychological make-up of cybercriminals, looking at some traits that perpetrators typically have in common. He highlights the following characteristics, most of which are shared with more general criminal profiles:<\/p>\n\n\n\n