Insider threat programmes started with counter-espionage cases in the government. Today, insider threat programmes have become a more common practice in all industries, as companies understand the risks associated with not having one. To build a programme, you must first understand what an insider threat is.

An insider threat is an employee, contractor, visitor or other insider who have been granted physical or logical access to a company that can cause extensive damage. Damage ranges from emotional or physical injury, to personnel, financial and reputational loss to data loss/manipulation or destruction of assets.

Financial and confidential information

While malicious insiders only make up 22% of the threats, they have the most impact on an organisation

Most threats are derived from the accidental insider. For example, it’s the person who is working on a competitive sales pitch on an airplane and is plugging in financial and confidential information. They are working hard, yet their company’s information is exposed to everyone around them. Another type of insider, the compromised insider, is the person who accidentally downloaded malware when clicking on a fake, urgent email, exposing their information.

Malicious insiders cause the greatest concerns. These are the rogue employees who may feel threatened. They may turn violent or take action to damage the company. Or you have the criminal actor employees who are truly malicious and have been hired or bribed by another company to gather intel. Their goal is to gather data and assets to cause damage for a specific purpose. While malicious insiders only make up 22% of the threats, they have the most impact on an organisation. They can cause brand and financial damage, along with physical and mental damage.

Insider threat programme

Once you determine you need an insider threat programme, you need to build a business case and support it with requirements. Depending on your industry, you can start with regulatory requirements such as HIPAA, NERC CIP, PCI, etc. Talk to your regulator and get their input.

Everyone needs to be onboard, understand the intricacies of enacting a programme

Next, get a top to bottom risk assessment to learn your organisation’s risks. A risk assessment will help you prioritise your risks and provide recommendations about what you need to include in your programme.

Begin by meeting with senior leadership, including your CEO to discuss expectations. Creating an insider threat programme will change the company culture, and the CEO must understand the gravity of his/her decision before moving forward. Everyone needs to be onboard, understand the intricacies of enacting a programme and support it before its implemented.

Determining the level of monitoring

The size and complexity of your company will determine the type of programme needed. One size does not fit all. It will determine what technologies are required and how much personnel is needed to execute the programme. The company must determine what level of monitoring is needed to meet their goals.

After the leadership team decides, form a steering committee that includes someone from legal, HR and IT. Other departments can join as necessary. This team sets up the structure, lays out the plan, determines the budget and what type of technologies are needed. For small companies, the best value is education. Educate your employees about the programme, build the culture and promote awareness. Teach employees about the behaviours you are looking for and how to report them.

Behavioural analysis software

Every company is different and you need to determine what will gain employee support

The steering committee will need to decide what is out of scope. Every company is different and you need to determine what will gain employee support. The tools put in place cannot monitor employee productivity (web surfing). That is out of scope and will disrupt the company culture.

What technology does your organisation need to detect insider threats? Organisations need software solutions that monitor, aggregate and analyse data to identify potential threats. Behavioural analysis software looks at patterns of behaviour and identifies anomalies. Use business intelligence/data analytics solutions to solve this challenge. This solution learns the normal behaviour of people and notifies security staff when behaviour changes. This is done by setting a set risk score. Once the score crosses a determined threshold, an alert is triggered.

Case and incident management tools

Predictive analytics technology reviews behaviours and identifies sensitive areas of companies (pharmacies, server rooms) or files (HR, finance, development). If it sees anomalous behaviour, it can predict behaviours. It can determine if someone is going to take data. It helps companies take steps to get ahead of bad behaviour.

If an employee sends hostile emails, they are picked up and an alert is triggered

User sentiment detection software can work in real time. If an employee sends hostile emails, they are picked up and an alert is triggered. The SOC and HR are notified and security dispatched. Depending on how a company has this process set-up, it could potentially save lives. Now that your organisation has all this data, how do you pull it together? Case and incident management tools can pool data points and create threat dashboards.

Cyber detection system with access control

An integrated security system is recommended to be successful. It will eliminate bubbles and share data to see real-time patterns. If HR, security and compliance departments are doing investigations, they can consolidate systems into the same tool to have better data aggregation. Companies can link their IT/cyber detection system with access control. Deploying a true, integrated, open system provides a better insider threat programme.

Big companies should invest in trained counterintelligence investigators to operate the programme. They can help identify the sensitive areas, identify who the people are that have the most access to them, or are in a position to do the greatest amount of harm to the company and who to put mitigation plans around to protect them. They also run the investigations.

Potential risky behaviour

Using the right technology along with thorough processes will result in a successful programme

You need to detect which individuals are interacting with information systems that pose the greatest potential risk. You need to rapidly and thoroughly understand the user’s potential risky behaviour and the context around it. Context is important. You need to decide what to investigate and make it clear to employees. Otherwise you will create a negative culture at your company.

Develop a security-aware culture. Involve the crowd. Get an app so if someone sees something they can say something. IT should not run the insider threat programme. IT is the most privileged department in an organisation. If something goes wrong with an IT person, they have the most ability to do harm and cover their tracks. They need to be an important partner, but don’t let them have ownership and don’t let their administrators have access.

Educating your employees and creating a positive culture around an insider threat programme takes time and patience. Using the right technology along with thorough processes will result in a successful programme. It’s okay to start small and build.

Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version Download PDF version

Author profile

Dan Bissmeyer Business Development Manager, AMAG Technology, Inc.

In case you missed it

Physical security and the cloud: why one can’t work without the other
Physical security and the cloud: why one can’t work without the other

Human beings have a long-standing relationship with privacy and security. For centuries, we’ve locked our doors, held close our most precious possessions, and been wary of the threats posed by thieves. As time has gone on, our relationship with security has become more complicated as we’ve now got much more to be protective of. As technological advancements in security have got smarter and stronger, so have those looking to compromise it. Cybersecurity Cybersecurity, however, is still incredibly new to humans when we look at the long relationship that we have with security in general. As much as we understand the basics, such as keeping our passwords secure and storing data in safe places, our understanding of cybersecurity as a whole is complicated and so is our understanding of the threats that it protects against. However, the relationship between physical security and cybersecurity is often interlinked. Business leaders may find themselves weighing up the different risks to the physical security of their business. As a result, they implement CCTV into the office space, and alarms are placed on doors to help repel intruders. Importance of cybersecurity But what happens when the data that is collected from such security devices is also at risk of being stolen, and you don’t have to break through the front door of an office to get it? The answer is that your physical security can lose its power to keep your business safe if your cybersecurity is weak. As a result, cybersecurity is incredibly important to empower your physical security. We’ve seen the risks posed by cybersecurity hacks in recent news. Video security company Verkada recently suffered a security breach as malicious attackers obtained access to the contents of many of its live camera feeds, and a recent report by the UK government says two in five UK firms experienced cyberattacks in 2020. Cloud computing – The solution Cloud stores information in data centres located anywhere in the world, and is maintained by a third party Cloud computing offers a solution. The cloud stores your information in data centres located anywhere in the world and is maintained by a third party, such as Claranet. As the data sits on hosted servers, it’s easily accessible while not being at risk of being stolen through your physical device. Here’s why cloud computing can help to ensure that your physical security and the data it holds aren’t compromised. Cloud anxiety It’s completely normal to speculate whether your data is safe when it’s stored within a cloud infrastructure. As we are effectively outsourcing our security by storing our important files on servers we have no control over - and, in some cases, limited understanding of - it’s natural to worry about how vulnerable this is to cyber-attacks. The reality is, the data that you save on the cloud is likely to be a lot safer than that which you store on your device. Cyber hackers can try and trick you into clicking on links that deploy malware or pose as a help desk trying to fix your machine. As a result, they can access your device and if this is where you’re storing important security data, then it is vulnerable. Cloud service providers Cloud service providers offer security that is a lot stronger than the software in the personal computer Cloud service providers offer security that is a lot stronger than the software that is likely in place on your personal computer. Hyperscalers such as Microsoft and Amazon Web Service (AWS) are able to hire countless more security experts than any individual company - save the corporate behemoth - could afford. These major platform owners have culpability for thousands of customers on their cloud and are constantly working to enhance the security of their platforms. The security provided by cloud service providers such as Claranet is an extension of these capabilities. Cloud resistance Cloud servers are located in remote locations that workers don’t have access to. They are also encrypted, which is the process of converting information or data into code to prevent unauthorised access. Additionally, cloud infrastructure providers like ourselves look to regularly update your security to protect against viruses and malware, leaving you free to get on with your work without any niggling worries about your data being at risk from hackers. Data centres Cloud providers provide sophisticated security measures and solutions in the form of firewalls and AI Additionally, cloud providers are also able to provide sophisticated security measures and solutions in the form of firewalls and artificial intelligence, as well as data redundancy, where the same piece of data is held within several separate data centres. This is effectively super-strong backup and recovery, meaning that if a server goes down, you can access your files from a backup server. Empowering physical security with cybersecurity By storing the data gathered by your physical security in the cloud, you're not just significantly reducing the risk of cyber-attacks, but also protecting it from physical threats such as damage in the event of a fire or flood. Rather than viewing your physical and cybersecurity as two different entities, treat them as part of one system: if one is compromised, the other is also at risk. They should work in tandem to keep your whole organisation secure.

Video surveillance is getting smarter and more connected
Video surveillance is getting smarter and more connected

The global pandemic has triggered considerable innovation and change in the video surveillance sector. Last year, organisations around the globe embraced video surveillance technologies to manage social distancing, monitor occupancy levels in internal and external settings, and enhance their return-to-work processes. Forced to reimagine nearly every facet of their operations for a new post-COVID reality, companies were quick to seize on the possibilities offered by today’s next-generation video surveillance systems. Whether that was utilising motion sensing technologies to automatically close doors or switch on lighting in near-deserted office facilities. Or checking if people were wearing masks and adhering to distancing rules. Or keeping a watchful eye on streets and public spaces during mandated curfew hours. Beyond surveillance and monitoring use cases, organisations also took advantage of a raft of new Artificial Intelligence (AI) applications to undertake a range of tasks. Everything from automating their building management and optimising warehouse operations, to increasing manufacturing output and undertaking predictive maintenance. Behind the scenes, three key trends all contributed to the growing ubiquity of video surveillance observed in a variety of government, healthcare, corporate, retail, and industry settings. Video surveillance takes to the Cloud Last year the shift to digital working led organisations to rapidly embrace cloud-enabled services, including cloud-hosted Video Surveillance As A Service (VSaaS) solutions that provide tremendous economies of scale and flexibility. Alongside significant cost savings, these solutions make it easier for organisations to enhance their disaster recovery and manage their video surveillance estate in new and highly effective ways. Surveillance cameras with audio recording were used more than 200% by customers between 2016 and 2020For example, in addition to enabling remote access and maintenance, today’s cloud-powered systems eliminate any need to invest in local storage technologies that all too often fail to keep pace with an organisation’s growing data storage requirements. Indeed, data from our worldwide customer base survey reveals how in 2020 an impressive 63% of organisations had abandoned using any on-premises storage option and were instead only storing all their video surveillance recordings and data in the Cloud. A deeper review of the global stats shows that the average cloud recording retention period for this stored data was 28.2 days, with organisations in Asia topping the global average at 38 days – 33% higher than was observed in any other region. Improvements in bandwidth and scalability engendered by the Cloud have also helped boost the growing utilisation of audio recordings in addition to visual image capture. Indeed, our research found the number of surveillance cameras with an audio recording facility used by customers jumped more than 200% between 2016 and 2020. Making sense of Big Data The enhanced ease of connectivity and scalable bandwidth made possible by the Cloud is stimulating more companies to connect a lot more video surveillance cameras to their networks. The top motivation for doing so is to generate live metrics and data that can be utilised to deliver enhanced business insights and operational intelligence. In recent years, a rich choice of video analytics solutions have been developed for a variety of industry verticals. The range of functionalities on offer is impressive and covers a variety of applications. Everything from making it easy to classify and track objects and behaviour patterns in real-time, to undertaking anomaly detection, or generating predictions based on past and present events/activities. Data collected via today’s cloud connected cameras can now also be used to feed deep learning training and AI analytics, utilising the unparalleled virtualised processing capacity of the Cloud to convert Big Data into usable information quickly. By integrating this information with data from other enterprise data capture systems, organisations are now able to gain a 360-degree view of their operations – in almost real-time. IT is now in the driving seat No longer the sole preserve of on-site security staff, the wider application and business use of video surveillance means that IT is increasingly taking the lead role where the management and control of these systems are concerned. IT is asked to integrate video surveillance into key enterprise platforms to generate the data that business leaders need Aside from the fact that IT has a vested interest in addressing the cybersecurity implications that come with attaching a growing range of IoT devices to the enterprise network, they’re also increasingly being asked to integrate video surveillance into key enterprise platforms to generate the data that business leaders need. As organisations expand their integration of video with other business applications, such as point of sale, access control, process control and manufacturing systems, this trend is only set to accelerate. Looking to the future Right now, the video surveillance industry is at a key tipping point, as video systems become increasingly strategic for enabling the enterprise to boost productivity, stay compliant, and fulfil its obligations to protect employees and customers. As the technology’s contribution to enhanced data-driven decision-making and problem solving continues to increase, expect the adoption of IP connected video cameras to burgeon as organisations look to capture more data from their day-to-day business operations.

How has Brexit affected the security industry?
How has Brexit affected the security industry?

When the United Kingdom voted to leave the European Union, a world of uncertainty unfolded for those doing business in the UK and the EU. The referendum was passed in July 2016. Including subsequent delays, the separation was completed after four years in January 2020, with a transition period ending December 2020. Even with the deadlines past, there are still pockets of uncertainty stemming from the separation. We asked this week’s Expert Panel Roundtable: How has Brexit affected the security industry?