In 2017. Snap Inc., the company famous for its Snapchat app was targeted in a phishing attack by a cheat pretending to be Evan Spiegel, the company’s CEO. The company stated that a single person was to blame for emailing the attacker payroll information of around 700 employees.
On a higher level, internal security vulnerabilities can affect millions of people. Maybe the most striking example comes from the credit - reporting giant Equifax which exposed sensitive financial information of nearly half of the US population. The huge data breach was caused by a series of errors inside the company - failing to keep software up to date and lacking internal controls.
The internal threats come from within the organization mostly when cyber-criminals attain the credentials of an employee or admin and gain access to the network. In some cases, a data breach can be caused by malicious employee or ex-employee, but often come as a result of negligence or accidental mistakes.
According to an Insider Threat report
by Cybersecurity insiders, experts view phishing attempts as the biggest vulnerability while the other threats include weak/reused passwords, unlocked devices, bad password sharing practice, and unsecured WiFi networks. The main enabling risk factors include too many users with excessive access privileges, an increasing number of devices with access to sensitive data, and the increasing complexity of information technology.Shred-it’s 2018 State of the Industry Report
also identified employee negligence as a major security concern for U.S. businesses and that the risk of a data breach is higher when employees work remotely. Workers continue to turn to pen and paper to take confidential business notes and they are often losing computers and mobile devices or leaving them vulnerable to theft.
The newest 2019 Verizon Data Breach
Investigation Report which aggregate data only from confirmed breaches showed that 34% of data leaks involved internal actors. That percentage should be taken seriously, but it’s hard to overlook the fact that 69% of attacks were perpetrated by outsiders. According to the same report, the only field of business which had the majority of breaches being associated with internal actors is healthcare.