The Case for Disclosing Insider Breaches

Too often organizations try to sweep intentional, accidental or negligent employee theft of data under the rug. Here's why they shouldn't.

Stolen credentials are often the entry point attackers use to access sensitive data, and often the first thing to come to mind is a cyber activist with an ax to grind, or a state-sponsored crime ring bent on financial gain or IP theft. But executives would do well to recognize that their own employees can play a significant role in compromising their organizations’ cybersecurity. Insider threats – accidental and inadvertent, or deliberate and malicious – are becoming increasingly common as technology rapidly evolves and employee education struggles to keep pace.

We rarely see accurate data regarding the scope of the problem when it comes to accidental or negligent employee insider threats. And unfortunately, organizations often try to sweep these breaches under the rug. As a CISO, I can sympathize with many organizations’ hesitation to include full breach details. Here’s why:

It will tarnish their brand. Companies want their customers to trust them especially as they are the keepers of more customer data than ever before. A breach can seriously erode that perception, and get customers thinking twice before they buy next time.
It’s expensive, and embarrassing! Regardless of the fact, many companies feel a breach reflects a failure on their part, and revealing the details may open them up to further questions about their practices and policies. Plus, cleaning up after a breach can also be very costly.
They aren’t required to disclose the breach. Right now, there are a patchwork of breach notification laws that can vary by state, industry and breach type. However, with emerging regulations such as the GDPR, we can expect to see a change.

These are all valid concerns. And although on the surface the consequences seem to greatly outweigh the benefits, hear me out…

I think organizations should seek to help one another by fully (or at least to the furthest extent possible) disclosing insider breaches whether they are malicious or inadvertent. This would help organizations better understand their adversaries and demonstrate where they need to focus cybersecurity training and education efforts.

Not convinced?

During the summer and fall 2016, a DuPont employee copied and removed thousands of files containing DuPont’s proprietary information including formulas, data, and customer information. Shortly after, the employee announced his retirement while simultaneously opening his own consulting business. Prior to his exit, another DuPont employee caught him taking photos of DuPont’s equipment with his personal phone. Without going into too much detail, the incident was reported up the management chain and naturally escalated from there. DuPont brought the alleged theft to the FBI and disclosed all the information they had up to this point.

The employee was at DuPont for 27 years. This, no doubt, could have seriously damaged DuPont’s reputation if they had not taken the appropriate approach. DuPont had the ability to quickly and quietly sweep this under the rug. Instead, the company gathered as much information as they could, reported the insider to the authorities, and demonstrated how it is very possible for other organizations do the same.

I applaud DuPont’s approach and will use this example to break down the advantages of disclosing insider breaches:

You get in front of the story (and the backlash). Suppose DuPont decided to keep this information to themselves. There is a good chance that eventually someone, somewhere would have figured it out. Instead, they were direct and upfront about the incident.
It enables companies to band together. We learn from each other’s mistakes! I have no doubt that organizations caught wind of DuPont’s approach and trained their employees on spotting insider threats. If it had been due to negligence or an inadvertent mistake, this would have also been a teachable moment.
There’s data for developing mitigation strategies. This can help inform an organization, or even best practices within an entire industry. Data can help reveal where the threats are and the scope and size of the problem.

So, the real question is, will organizations’ mentality ever change? When will they begin to realize the benefits of disclosing breaches to help one another out and work toward the greater good?

In highly regulated industries, we are beginning to see change. As regulations around data become more prevalent (as we are seeing in the EU and beyond), publicly-traded companies will be required to explain how breaches occurred within a fully developed breach report. It’s the smaller and self-contained industries and businesses that we will continue to rarely hear about; they tend to keep the classified information that they contain and clean up in-house.

Insider threats are some of the most serious threats a company can face. By disclosing and sharing the comprehensive data we collect on real-world incidents, we can better educate employees, reduce the success of malicious actors and build more secure environments and stronger overall organizations.

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register.

Related Content:

With 15-plus years of leadership experience implementing vendor security risk and assessment programs for startups and Fortune 500 companies, Jackson defines the security road map for SecureAuth's suite of adaptive authentication and IS solutions. Prior to joining SecureAuth, ... View Full Bio