Insider Threats Are Alive and Well. Take These 6 Steps to Reduce Risk.

It’s been more than five years since Edward Snowden revealed that he stole classified information from the National Security Agency. Since then, malicious insider attacks have continued to embarrass and damage federal operations.

The most recent insider attack on a federal agency involved a former NSA developer. According to the Justice Department, Nghia Hoang Pho evaded detection between 2010 and 2015 as he illegally exfiltrated classified information from the agency.

Malicious users are a significant driver of the insider threat but not the only one. Research shows that user negligence and susceptibility to attack are the main drivers behind insider incidents. Our assessments show that negligence causes almost 70 percent of all insider incidents. The IBM X-Force Threat Intelligence Index concluded the same.

Fixing the Problem

Numerous insider threat mitigation programs and strategies have been available for years. In 2011, the U.S. established the National Insider Threat Task Force. This organization develops governmentwide insider threat programs for deterrence, detection and mitigation. A number of auditor reports have identified ways to close insider risk gaps. There is no shortage of technologies on the market designed to defend against the problem. There are even federally sponsored insider threat training courses available.

Despite awareness of the problem and solutions, government agencies continue to fall victim to insiders. However, there are ways to strengthen defenses. Here are six steps government agencies can take to lessen the likelihood of falling victim to malicious and negligent insiders.

1. Acknowledge your risk.

The first step to solving any problem is to admit it exists. If you aren’t sure whether or not your organization has insider risk, there are resources available to help you identify specifically what it is. The U.S. Committee on National Security Systems defines an “insider” as any person with authorized access to any US government resource. This includes personnel, facilities, information, equipment, networks, or systems. CNSS defines “insider threat” as an insider that uses authorized access, wittingly or unwittingly, to do harm to the security of the U.S. If your organization has humans that could be described by either of these definitions, then it has insider threat risk.

2. Gain visibility.

To defend against insider threat attack vectors, organizations need to know how systems are being accessed, how data is being shared, which applications are in use, and what URLs are being clicked on. There are technologies available that provide the intelligence needed to gain visibility over all activities and behaviors. When choosing such tools, look for those that can be quickly deployed and managed, scale across vast numbers of users, monitor behaviors taking place on and off networks, and which create little to no impact on system and user performance.

3. Enable early warnings.

Many organizations have solutions in place to notify them when suspicious activities are in play. Many "early warnings" turn out to be false positives. This leads to alert fatigue and missed attacks. To provide value, alerts have to be driven by technologies that understand behavioral context, know when events are normal or anomalies, and what user intent is.

4. Find and use teachable moments.

Organizations that want to defend against insider threats need to enlist employees’ assistance. Most trusted users likely aren’t thinking about security first. This doesn’t have to create a further challenge. Organizations should implement awareness and training programs. These should provide information about when and where actual mistakes and malicious behaviors are taking place. Studies show that with education, humans can reduce their susceptibility rates to attacks by as much as 70 percent.

5. Be open.

Your most trusted insiders can play a vital role in strengthening security. A recent Harris Poll we sponsored revealed that a majority of American employees will support and accept monitoring that is conducted for security purposes. They simply ask that their employers be upfront about such programs.

6. Respect privacy.

When certain types of risky behaviors are detected, security teams could choose to quarantine users, change access privileges, or use legacy tools such as keystroke loggers for deep surveillance. The majority of insider threat detection use cases do not require the use of invasive technologies. Most of the time, insider threats can be detected without exposing users’ personal information or identities. When evaluating technologies for privacy capabilities, look past marketing claims and advertisements. Ask providers to prove that they offer features that allow collected data to be anonymized and protected against unauthorized eyes.

Christy Wyatt is the chief executive officer of Dtex Systems. David Wilcox is the vice president of federal for Dtex Systems.