Types of Insider Threats Risking Your Company’s Security and Productivity

As companies navigate a confusing business environment defined by pandemic-inspired changes, new workplace arrangements, and economic uncertainty, leaders are looking to address two issues impacting bottom-line results: security and productivity. These are issues are in large part affected by the workforce behaviors and the different types of insider threats they present.

Their priorities are well-placed. Cybersecurity threats have soared in the past decade, rising sharply each year in scope and consequence. As IBM’s most recent data breach study notes, “For 83 percent of companies, it’s not if a data breach will happen, but when.”

Meanwhile, many managers are also gripped by productivity paranoia, worried that workers are not giving their best when the company needs it the most. According to the Bureau of Labor Statistics, employee productivity plunged last year, reaching its lowest level since 1947, giving historical context and credence to their concerns. 

Why Insider Threats Are A Cause for Concern

According to one industry report, more than 1,800 data compromises impacted more than 422 million people and exposed sensitive information that can further empower threat actors. With the average cost of a data breach approaching $9.5 million in the U.S., companies have plenty of reasons to upgrade their defensive postures. As a result, more than half of companies expect to increase their IT spending in 2023.

Fortunately, companies don’t have to focus on a multifaceted threat landscape to prevent the next cybersecurity incident. Verizon’s Data Breach Investigations Report found that 82 percent of data breaches involve the “human element,” a broad term describing company insiders who put data privacy and cybersecurity at risk. 

Meanwhile, a deluge of headlines documenting The Great Resignation, Quiet Quitting, and now layoff cycles are causing leaders to reexamine productivity. 

Whether leaders are grappling with cybersecurity risks or responding to productivity concerns, they are focused on equipping, empowering, and holding their employees accountable. 

What is an Insider Threat?

An insider threat refers to a cybersecurity risk to an organization by individuals within the company. Insiders have access to a company’s data and IT infrastructure, including executives, staff members, contractors, and trusted third-party entities. Possible insider threats include: 

• Individuals with elevated privileges, including network administrators, executives, business partners, and others with access to sensitive information
• Developers who have access to data through development or testing environments
• Former employees who retain active profiles and credentials
• Acquisition managers and staff members
• Vendors with internal privileges
• Contractors who hold internal access
• Partners with internal privileges.

These threats can originate from malicious or intentional actions or from simple negligence or carelessness. However, these threats frequently go unnoticed and undetected because their “insider” status means they are overlooked when it comes to threat mitigation initiatives. 

Insider Threat Identification and Defense Techniques

Insider threats come in many forms, and leaders must understand their varied vulnerabilities, methodologies, and mitigation strategies that can prevent insiders from undermining data privacy or cybersecurity. 

In general, there are five categories of insider threats, including accidental insiders, negligent insiders, compromised insiders, malicious insiders, and recruited insiders. 

Accidental Insider Threat

Accidental insider threats unintentionally undermine cybersecurity because they lack knowledge about security policies or make mistakes when executing their day-to-day priorities. 

For example, accidental insider threats might send sensitive information to the wrong recipient, lose a device containing confidential data, or download malware onto a company device.

How to Detect an Accidental Insider

Human error is one of the most significant cybersecurity vulnerabilities, requiring companies to put policies, procedures, and cybersecurity solutions in place to reduce opportunities for error and equip people to make better decisions. 

This can include training in cybersecurity best practices, implementing guardrails to moderate employees’ decisions, and software solutions that protect employees and companies from accidentally harmful decisions. 

Negligent Insider Threat

Insiders who are unaware of security threats or choose to ignore protocols to achieve work efficiency can fall victim to social engineering attacks.

In today’s hybrid work environment, with an alarming 64 percent of employees using personal devices for work without proper security measures, careless insiders pose a significant risk to cybersecurity and data privacy.

Furthermore, with over a third of employees neglecting to update their passwords, the likelihood of threat actors exploiting employee negligence to gain access to company accounts and networks is heightened. 

How to Protect Against Negligent Insider Threats

User and entity behavior analytics can help companies identify potentially problematic behavior while ensuring that teams follow basic best practices for keeping accounts and data secure. When coupled with endpoint data loss prevention solutions, companies can effectively prevent negligent insiders from undermining cybersecurity.

Compromised Insider Threat

While the total number of data breaches declined slightly last year, the number of people impacted by breaches increased by 42 percent year-over-year. This compromised data can give threat actors front-door access to company networks and IT systems, potentially exposing companies to data breaches, ransomware attacks, and other cyber crimes. 

The 2021 ransomware attack on Colonial Pipeline serves as an example, where a breached employee account with an outdated password was the entry point for hackers to disrupt a significant US natural gas pipeline, reflecting the potential risk of compromised insider threats. 

How to Detect and Mitigate Compromised Insiders

To prevent compromised employees from undermining cybersecurity, companies can implement a multi-layered approach that involves regular training, access management, monitoring and detection, background checks, incident response planning, and third-party risk management. 

Employee training helps to educate employees on the importance of cybersecurity and the risks associated with security breaches, while access management restricts access to sensitive systems and data.

Specifically, monitoring and detection systems can help identify potential threats and respond to them quickly.

Malicious Insider Threat

Insiders who act maliciously use their data or network access to intentionally inflict harm on an organization. These threat actors are stealthy as they operate under the organization’s implicit trust, and they frequently know how to evade detection.

Any employee or contractor can pose an insider threat; however, those with high-level privileges are particularly dangerous due to their access to confidential information and are more likely to trigger a cybersecurity or data privacy breach.

How to Mitigate Malicious Insider Threats

Stopping malicious insiders requires a combination of human intelligence and software solutions. People have unique insights into their peers and coworkers, so a “see something, say something” policy can help companies identify malicious insiders. 

At the same time, powerful software solutions can help companies detect, investigate, and prevent insider threats, making it a critical collaborator with an organization’s human intelligence. 

Recruited Insider Threat

Sometimes, employees or contractors collude with external parties. These individuals may be motivated by financial gain or recruited through dark web channels. They provide access, control, or permissions to an external attacker, who leverages this insider’s assistance to carry out their attack. Despite being carried out by an outsider, these attacks are facilitated by the actions of an insider.

In 2018, Tesla experienced “extensive” sabotage by a disgruntled employee who used his credentials to access, download and distribute company data to third parties, including photo and video assets. 

Data-driven endpoint monitoring, behavior rules, and real-time alerts can help prevent recruit insiders from accessing or extracting company data. 

Why Insider Threats are a Productivity Risk

While insider threats are rightly understood as cybersecurity risks, negative employee behavior is also a threat to productivity and operational efficiency. This expanded understanding of insider threats can help leaders best support their teams, ensuring that employees are assets, not liabilities.

Types of Insider Threats Threatening Productivity

Like cybersecurity threats, there are different types of productivity pitfalls that require unique approaches to identify challenges and improve employee performance. This includes disengaged employees, employee burnout, and Quiet Quitting. 

Disengaged Employees

While some studies ominously report absurdly high levels of employee disengagement, actual metrics can be difficult to track. However, we have enough scientific evidence and anecdotal examples to know that employee engagement is down. 

As a Gallup analysis notes, “U.S. employee engagement needs a rebound in 2023.”

Instead, many people are performing what the writer John Herrman describes as “work-like non-work,” activity that is ostensibly professional work but is actually performative, neither advancing organizational outcomes nor inspiring employee excellence. 

This might include interminable email chains, continual Slack threads, and other low-level online activities that consume much of our “work” day. 

Understanding these behaviors and redirecting employees to the team’s core mission and vision can help companies re-engage their teams, but first, they need to understand what’s going on at work. 

Employee Burnout

Employee burnout is endemic in today’s workplace. According to one survey, 43 percent of U.S. workers “feel burned out at work,” a 40 percent increase from pre-pandemic levels. Unsurprisingly, 77 percent of companies say they see an increase in employees identifying as burned out. 

While the reasons are multifaceted, many employees are struggling to manage their growing workloads, effectively manage stress, and connect with their coworkers and leaders. 

Employee analytics can help companies respond effectively. These insights can help leaders better understand employee workloads, productivity trends, and best practices. For instance, Microsoft leveraged its people analytics to identify its employees’ peak productivity hours and empower them to get work done during those times by reducing meetings and other obligations. 

This helps people lower stress, improve output, and reduce turnover, helping companies and their employees thrive at a critical time. 

Quiet Quitting

Quiet Quitting means different things to different people, but it generally refers to employees setting better boundaries by limiting their professional activities to their stated job descriptions. 

This type of quitting can have a negative impact on the workplace as it can lead to decreased productivity, a loss of institutional knowledge, and create additional workload for remaining employees.

However, quiet quitting is a symptom, not a cause. In some ways, it’s the natural outcome of disengaged and stagnant employees. It’s also more than just a passing trend, requiring leaders to better understand their employees’ motivation, performance patterns, and future aspirations to help them thrive in the current and future workplace. 

Conclusion

Companies are facing a dual challenge of security and productivity in the current business environment. 

Organizations can mitigate the risk of insider threats by implementing a multi-layered approach that includes training, access management, monitoring, background checks, and incident response planning. Leaders must equip, empower and hold their employees accountable to prevent the next cybersecurity incident and ensure optimal productivity.

Stay protected against any type of insider threat with Teramind