In 2018, 34% of all company data breaches came from the inside. That means that on average, a third of the risk a company faces when it comes to network security comes from insider threats — our own employees. With all the work and effort we put into protecting our company’s data, this can feel, at best, demoralizing. What do we do when so much of the danger stems from our own team? When we make every effort to protect our network from intruders, and a third of those ‘intruders’ will simply have access anyway — because we gave it to them?
How can we mitigate this particular kind of risk? We can’t simply start treating our employees like suspicious actors; such treatment would decimate morale and, ironically, probably make the insider risk more steep. If your team feels mistreated, or believes you don’t trust them, you might find them unmotivated to protect company data.
But we can’t just sit back and hope everything turns out all right. With statistics so clearly demonstrating a risk, it’s clear we must take action to mitigate that risk. But what should that action be? How can you work to ensure your team will protect your data — without alienating them altogether? The answer is at least threefold: give your team the tools they need to spot risks, the knowledge they need to recognize the risks, and the trust necessary to care.
PREVENTING INSIDER THREATS: A THREEFOLD PROCESS
- Use AI as much as possible. Part of the risk of internal threat isn’t necessarily malicious — it’s just the natural course of human error. The more repetitive a task is, the less skilled a human will be at that task long term. They’ll eventually start making mistakes; our brains just aren’t wired to do unending repetition. Constantly searching for irregular activity in your network, for example, is something that AI can master better than a human can. Many companies are already catching on: 73% of enterprises are pushing AI in their cybersecurity plans, especially in network security. Let the people make the higher-level decisions, look into unique threats, and solve problems. Let the AI take on everything else. Your team will thank you, and your security will ultimately be stronger.
- Educate your team. Your employees can’t mitigate risks they can’t recognize. Network security is no longer exclusively the realm of the CISO or the IT team; it’s everyone’s business. Make it a team event. Let them know this is part of the job, then train them on exactly what that means. With the constantly shifting nature of cybersecurity, this means regularly updated training — not just once a year. Make sure everyone understands the latest threats, what they can look out for, and what exactly to do if they suspect a hack. There’s a bonus here, too: Research shows that companies who invest in training for their employees enjoy a 24% higher profit margin, and much higher employee retention.
- Build employee buy-in. The bottom line all companies have to face is this: Giving anyone access to your network, including your employees, is a risk. But it’s a risk you have to take if you want to stay productive and keep growing. Minimize that risk by building team camaraderie, developing healthy relationships, and rewarding your employees for hard work. Building trust, teamwork, and showing appreciation all help employees to feel connected at work — to feel more at home. Happy, thriving employees don’t want to expose company data; on the contrary, they’ll be all the more motivated to protect data they see as essential to their own well-being. Even better, share your vision with your team — show them how your work is making the world (or your market) a better place. Employees feel more connected to work they’re passionate about. Another benefit here is much higher employee engagement, which ultimately makes your team more productive.
When we hear statistics telling us the call is coming from inside the house — or the risk is coming from inside the company — we might have the urge to cast everyone we work with in a suspicious light. Fight that instinct; the more suspicion you treat your team with, the less secure their work will be. Preventing insider threats is about building trust; it’s about connecting with your team in such a way that they feel valued and engaged, and therefore all the more motivated to protect their company data. Then, it’s simply a matter of providing the right tools and the right education, and not only will your network be that much more secure — your company will be more productive with a happier, cybersecurity-conscious team.