3 Overlooked Commercial Security Threats
Business security is a tough job. From the persistent attacks from new threats to the rising impact of any breach, those tasked with safeguarding business-critical data face the challenge of juggling mundane, day to day security requirements with the need to stop the ever more creative hacking attempts.
It is, however, unfortunate that many security experts are focusing more of their money, time, and effort trying to prevent abstruse potential threats, and less on the routine, tried, and proven security activities, creating a simple and obvious loophole for attacks. A lot of attention if given to external threats through encryption, firewalls, identification, authentication, passwords, non-repudiation, VPN, and a wide range of software and hardware security systems.
Yet, little attention is directed towards internal vulnerabilities that can easily become a real threat to the organisation. The following are some of the most commonly overlooked security threats and ways in which businesses can protect against them:
- Disgruntled employees
Internal attacks by rogue employees are one of the biggest threats for business data and systems. Personnel in the IT department are particularly dangerous as they have both knowledge and access to admin accounts, data centres, and networks.
You can mitigate this risk by closely monitoring, controlling, and managing privileged credentials. Terminate all privileged accounts and credentials that are no longer in use – because the employees they were assigned to are no longer working at the company or some other reason. In addition, implement protocols and set up infrastructure to track, log, and record account activity – especially for privileged accounts – and create alerts for malicious activity to enable quick response.
- Mobile Devices
Data theft can be a serious concern when employees are permitted to use their mobile devices to access company information or share data. Actually, a recent study reported that mobile security breaches affected about 68 percent of global organisations in 2014. With employees using their own devices for work related tasks, they risk exposing company information in the event that an app installs malware or other software that can access the network connection.
To mitigate this risk, the company should have a strict mobile device policy in place so employees are better informed on device expectations, and enterprises can monitor files and documents being downloaded to company or personal devices. This will promote visibility into the organisation’s mobile data loss risk and facilitate faster detection of exposures in the event that a mobile device is lost or stolen.
- Cloud Applications
Cloud-based file access and sharing creates room for internal and external breaches. Cloud-based threats can be mitigated by defending at the data level, like when using strong encryption and retaining the keys exclusively to avoid third parties from accessing the data, even when stored on a public cloud.
Internal security threats can be much harder to address, so organisations need to not only enforce strict internal policies and procedures, but also use direct action to ensure that organisational data, information, and knowledge is secure.
