The Case for Disclosing Insider Breaches

Stolen credentials are often the entry point attackers use to access sensitive data, and often the first thing to come to mind is a cyber activist with an ax to grind, or a state-sponsored crime ring bent on financial gain or IP theft. But executives would do well to recognize that their own employees can play a significant role in compromising their organizations’ cybersecurity. Insider threats – accidental and inadvertent, or deliberate and malicious – are becoming increasingly common as technology rapidly evolves and employee education struggles to keep pace.

We rarely see accurate data regarding the scope of the problem when it comes to accidental or negligent employee insider threats. And unfortunately, organizations often try to sweep these breaches under the rug. As a CISO, I can sympathize with many organizations’ hesitation to include full breach details. Here’s why:

These are all valid concerns. And although on the surface the consequences seem to greatly outweigh the benefits, hear me out…

I think organizations should seek to help one another by fully (or at least to the furthest extent possible) disclosing insider breaches whether they are malicious or inadvertent. This would help organizations better understand their adversaries and demonstrate where they need to focus cybersecurity training and education efforts.

Not convinced?

During the summer and fall 2016, a DuPont employee copied and removed thousands of files containing DuPont’s proprietary information including formulas, data, and customer information. Shortly after, the employee announced his retirement while simultaneously opening his own consulting business. Prior to his exit, another DuPont employee caught him taking photos of DuPont’s equipment with his personal phone. Without going into too much detail, the incident was reported up the management chain and naturally escalated from there. DuPont brought the alleged theft to the FBI and disclosed all the information they had up to this point.

The employee was at DuPont for 27 years. This, no doubt, could have seriously damaged DuPont’s reputation if they had not taken the appropriate approach. DuPont had the ability to quickly and quietly sweep this under the rug. Instead, the company gathered as much information as they could, reported the insider to the authorities, and demonstrated how it is very possible for other organizations do the same.

I applaud DuPont’s approach and will use this example to break down the advantages of disclosing insider breaches:

So, the real question is, will organizations’ mentality ever change? When will they begin to realize the benefits of disclosing breaches to help one another out and work toward the greater good?

In highly regulated industries, we are beginning to see change. As regulations around data become more prevalent (as we are seeing in the EU and beyond), publicly-traded companies will be required to explain how breaches occurred within a fully developed breach report. It’s the smaller and self-contained industries and businesses that we will continue to rarely hear about; they tend to keep the classified information that they contain and clean up in-house.

Insider threats are some of the most serious threats a company can face. By disclosing and sharing the comprehensive data we collect on real-world incidents, we can better educate employees, reduce the success of malicious actors and build more secure environments and stronger overall organizations. 

Check out the all-star panels at the 'Understanding Cyber Attackers & Cyber Threats' event June 21 and get an in-depth look at your cyber adversaries. Click here to register. 

Related Content: