It is not uncommon for companies to lose data, including national ID and Social Security numbers. But in many cases, corporate secrets are leaked by malicious insiders.
Recently, an employee of the National Security Agency (NSA) was accused of sharing top-secret information with an unauthorized individual.
The Department of Justice’s indictment alleges that a 60-year-old man from Maryland willfully transmitted classified national defense information on 13 occasions between 2018 and 2020 to another person who was not entitled to receive it. He faces a maximum sentence of 10 years imprisonment for each of the 13 counts.
While most organizations experience data loss or exfiltration caused by an employee mistake, malicious insiders are responsible for 27% of incidents, new research from Tessian and the Ponemon Institute revealed.
After surveying 614 IT security practitioners across the globe, the researchers found that nearly 60% of organizations experienced data loss or exfiltration caused by an employee mistake on email in the last 12 months.
The most common types of information that companies lose include customer information, intellectual property, consumer data, and user-created data, such as credit cards, national ID, and Social Security numbers.
Data loss – whether accidental or intentional – is a major threat and should be treated as a top priority,
Tessian Chief Information Security Officer Josh Yavor said.
Corporate data loss induces reputational damage and persecution for non-compliance with data protection regulations. A previous Tessian study revealed that almost one-third of businesses lost a client or customer because of an employee sending an email to the wrong person.
“Organizations cannot protect what they can’t see. A lack of visibility of sensitive data that employees transferred from the network to personal email was cited as the most common barrier (54%) to preventing data loss,” the new research reads.
As a result, it takes security teams 72 hours, on average, to detect and remediate a data loss and exfiltration incident caused by a malicious insider on email, and almost 48 hours to detect and remediate an incident caused by a negligent employee.
“Our findings prove the lack of visibility organizations have into sensitive data, how risky employee behavior can be on email, and why enterprises should view data loss prevention as a top business priority,” Larry Ponemon, chairman and founder of Ponemon Institute, said.
Due to the huge spike in voluntary resignations at the height of the COVID pandemic, the threat of malicious insiders could only become worse. Earlier in 2022, another research by Beyond Identity found that as much as 56% of workers used remaining account access to harm their ex-employer. This value increased to 70% for fired employees.
According to a 2020 report cited at the annual meeting of the World Economic Forum (WEF), 63% of workers who quit their jobs said they had used data from old roles in their new positions – and since then, of course, the overall number of people joining the Great Resignation has only increased.
With around 4.5 million resigning last November alone, the WEF appears justified in its assertion: “the Great Resignation could actually be one of the biggest insider threats facing organizations in a generation.”
More from Cybernews:
‘Space pirates’ penetrate deep into Russia’s aerospace industry
Crypto traders call for compensation
Is cyberwarfare not as scary as we feared?
TOP10 system cracks cybercriminals exploit to break in
US accuses doctor of designing ransomware
Countries brace for cyberattacks as Sweden and Finland move to join NATO
Subscribe to our newsletter
