In the realm of cybersecurity, insider threats are one of the most potentially dangerous forms of network compromise. As agencies purchase and develop tools to track where their employees go on the network and what they are accessing, a new report shows almost half were targeted by insiders over the last 12 months.
A MeriTalk survey of 150 federal IT managers — 36 percent from defense and intelligence agencies — conducted by MeriTalk revealed that 45 percent of agencies had employees or contractors that tried to access or exfiltrate unauthorized data over the last year. The survey also showed that 29 percent of agencies suffered a loss of data because of an insider during the same time period.
At the same time, 40 percent of those polled said employees at their agency gain unauthorized access to sensitive documents at least weekly.While those numbers are alarming, the survey notes that 40 percent of those incidents were due to accidental leaks, rather than malicious intent.
“There’s no shortage of news stories underscoring the risks of government data breaches, particularly those perpetrated by insiders, whether malicious or unintentional,” said Rob Potter, vice president of public sector for Symantec, which underwrote the survey.
Potter said agencies have to battle insider threats with two weapons: technology and training.
“Agencies must take a holistic approach when implementing formal insider threat programs to battle this risk head-on,” he said. “Investments in the right technology, as well as employee training and education, are critical.”
According to the survey, more than 40 percent of agencies don’t track data assets on the network, meaning they can’t be sure when and how specific documents are shared or otherwise exfiltrated.
The survey also notes that 55 percent of agencies have an insider threat detection program and more than three-quarters of those polled said managing insider threats is a top priority.
The report’s authors suggest establishing a formal insider threat program, developing training for employees and setting up IT “trip wires” to detect anomalies. The report also touts the importance of administration efforts like Information Security Continuous Monitoring, the Continuous Diagnostics and Mitigation program and presidential cross-agency priority goals around cybersecurity.
MORE INFO: C4ISR & Networks and Federal Times proudly present CyberCon 2015, a forum to discuss how to secure defense and federal networks. Join us Nov. 18 at the Ritz Carlton in Pentagon City, Virginia.
