Content:
Computer security experts analyzed the causes of corporate data breaches. Over the past year, companies have lost three times more data through the fault of their own employees rather than as a result of external hacker attacks.
In the first half of 2021, 65% of data breaches occurred because of internal violators – meaning the employees of the affected organizations themselves. Outside hacker attacks were the cause of leaks half as often, only 30% of cases. For comparison, last year, external factors caused 44% of data breaches, and internal factors caused 55% of data breaches.
In total, more than half of the cases are those when an ordinary, “unprivileged” employee became the culprit. In 3.5% of cases, contractors are guilty, in 2.5%, managers are guilty, in 2% of cases, former employees are guilty, and in 1.3% cases, administrators are guilty.
According to security experts, internal leaks have a very high risk for the company since the negative consequences from such leaks can be greater than from external ones. This is due to the fact that external attacks target homogeneous data: information about users or information about those who used a particular service. Any data, including those that are most sensitive for the company, can be compromised as a result of a data breach caused by a malicious insider.
In recent years, there has been a significant increase in data breaches in commercial, non-profit and government organizations. In the course of these security incidents, several billion records were compromised – personal and payment data, including credit card data, social security numbers and other similar information. All those organizations should definitely invest more in stronger security software solutions.
At the same time, it is expected that in the future, the amount of data lost due to the employees’ own fault will decrease slightly, and the amount of data that was deliberately stolen by attackers will decrease significantly as well, possibly several times. This trend has already begun to manifest in the last few months.
Experts believe that a strong decrease in the amount of data compromised through the fault of an external source is associated with an increase in administrative pressure from government players. The tangible penalties against hacked organizations are obviously forcing the management of companies processing large amounts of data to think about increasing the level of information security.
What is leaking
Basically, in 70% of cases – the personal data of employees and customers get stolen. The next big segment is payment information, which accounts for 22% of data breaches. Another 5% and 4% are state secrets and trade secrets, respectively.
In terms of the leakage channel, the Network category is the leader with a 70% share. This includes leaks through the browser or cloud storage. Almost 10% is attributed to paper documents, and 9% is due to email leaks. In other cases, data breaches occurred through instant messengers, removable media, mobile devices, as well as the loss or theft of equipment.
In addition, experts point out the growth of mega data breaches – those when more than 10 million records were lost at a time.
Demand for information
Actually, it is not high-tech hacker attacks that are more common. Banal theft is all over the place. However, the greatest harm to companies is still caused by high-tech hackers, even if it is less common – such as theft of money, information, or sabotage through ransomware viruses. However, there are also threats coming from within.
It happens that attackers turn off DLP systems on their own because they are the administrators of such systems. The customer base can be copied by those who have access to it, for example, sales managers. Protection against such leaks lies not only in the adoption of DLP systems but also in the correct staff motivation and corporate culture.
Despite the fact that DLP systems are able to track every click of an employee in the office, such systems are not designed to protect against intruders but rather from an unintended insider. They are not able to track the human factor. A motivated employee can simply take a photo of any important documents on a personal phone or other mobile device and send it to the attacker.
The share of attacks aimed at obtaining data in 2021 continued to grow. 60% of all offers for the sale of data are user accounts used to access various online resources, including banking applications. Credentials can be sold individually for up to $10 or in batches of up to several million records that cost hundreds or thousands of dollars.
Therefore, an attack in which information was obtained may soon be followed by a new one – an attack on the owners of this data or on the company whose employees’ credentials have been compromised.
How to stay safe
In order to minimize the number of data breaches and identity theft cases, the first step is to raise user awareness of account retention issues.
Employees’ digital identity is very important. And there is a big problem with reliance on digital identity: virtual persona can be fabricated by anyone at any time. As we enter an increasingly digital future, secure and trusted digital identities will become an increasingly important part of our lives.Fortunately, there are countless good online identity monitoring services out there to protect our digital identity, and there will no doubt be other groundbreaking innovations in this area.
