According to BBC news article by Maggie Shiels (Feb 11, 2009) the world’s biggest software maker has warned companies to expect an increase in “insider” security attacks by disgruntled, laid-off workers. Microsoft said so-called “malicious insider” breaches were on the rise and would worsen in the present downturn.
Below are the high points:
• With 1.5 million predicted job losses in the US alone, there’s an increased risk and exposure to these attacks
• Insider threat is one of the most significant threats companies face. Said Microsoft Doug Leland
• The malicious insider is classed as the greatest security concern because they have access, and relatively easy access to corporate assets
• During economic insecurity people are motivated by revenge, fear or greed
• 88% of data breaches were caused by simple negligence on the part of staff
• Employees steal information to sell to a third party, to get back at a company for being laid off or demoted or to try and get a job at another company
• Even though Insiders attacks are lower in numbers but they could be more devastating because the employee knew where “the crown jewels” were kept – unlike a hacker who had to go on something of a “fishing expedition” to find a company’s valuable assets
• The outstanding, unsolved, unaddressed risk management problem that has existed for years is that everyone is focusing on the hacker
• Data loss prevention systems specialize in the detection of precisely these events
Here is the article: Malicious insider attacks to rise
To find the correct balance between data security and data availability, organizations are urged to buy a copy Data Breaches: Trends, costs and best practices.
Even in good time management focused on driving shareholder value by increasing revenue and profits. I think during this economic downturn information security will be the last thing on their mind which will not only compound the problem but gives an edge to a attacker and simply a bad business decisions considering the circumstances. It’s about time to start paying attention to regulatory compliance for sake of securing organization assets. Good place to start is to have some sort of baseline based on information security framework and come up with a strategy to improve that baseline. ISO assessment can be utilized to baseline the organization security posture and is a great first step towards ISO 27002 compliance or for that matter any compliance audit.
What do you think board rooms are appropriately prepared to tackle or perhaps slow down the wave of data breaches coming our way?
• Related article
Unstable Economy and Insider Threats
Economic Crisis Tops Security Threats to U.S
Detecting Insider Threats
httpv://www.youtube.com/watch?v=2Ce3S6DkvwY
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=6b35ca8c-42a0-4753-be84-5a6d5b4c5394)
