Data breaches are largely looked upon as external attacks, but that is not true at all. A large number of them can happen internally. In fact, around 42% of data breaches are external while the rest are largely internal. In fact, insider threats are cited to be one of the biggest causes of data breaches. Internal breaches are more dangerous and damaging because the amount of sensitive data that gets exposed can much larger than if the threat was from the outside.
Who is Responsible for Internal Breaches?
So who is to blame for an internal breach? Largely the employees, but the employers of the business share the blame as well. Poor training, management as well as poor cybersecurity contribute to internal breaches. In fact, the risk of an internal breach that is associated with a business can be broken down into the following:
- 60% – Specialized employees who have access to sensitive data and understand the software and database of the business
- 57% – Third party consultants, contractors and others like them.
- 51% – The average employee
The silver lining to see here is that internal breaches are not always malicious in nature. The reason behind the internal breach can also be further divided into the following percentages:
- 71% of internal breaches are mistakes that are caused by carelessness or accidents by the employees
- 68% of internal breaches are a willful ignorance of the policy rules. These attacks are not always malicious in nature and can be chalked up to an overworked employee looking to work faster by making shortcuts
- 61% of internal breaches are caused by malicious intent where the person is choosing to cause harm to the business.
An example of an accidental data breach can be evidenced by what happened in 2014 to the IRS. An employee used a thumb drive to download the private data for 20,000 individuals. He then took it home and plugged it into his laptop. In the eyes of an average computer user, there is nothing wrong here. Except that was against the IRS rules and even if the data was not misused, the IRS was obligated by law to inform all 20,000 individuals that their data had been put at risk.
Measures a Business Can Take
Considering how devastating a data breach can be for a business, active measures need to be taken to ensure that your business doesn’t have to face one. The following are some simple measures that a business can deploy:
- Better Training – Businesses need to train their employees and inform them about proper security measures that are enforceable. This is also a great opportunity to discuss the importance of cybersecurity, internal breaches and more.
- Proper Protocols – Identify proper protocols when it comes to answering emails, downloading files and more. Often times, internal breaches also occur because of malware in emails or in the downloaded files.
- Prioritize Your Cyber Security – Many businesses don’t focus on improving their cybersecurity. A common belief is that only big businesses are being targeted. On the other hand, many hackers and scammers target small businesses for this very reason.
