A Review On Employee Behavior

Security and ethical employees will continue to be a vital aspect of ensuring the success of an organization. There will always be a need for ethical IT security professional as hackers will continue to force organizations to make adjustments in their business models to protect their employees, data and customers. Many organizations and managers believe application security requires simply installing a perimeter firewall, or taking a few configuration measures to prevent applications or operating systems from being attacked. This is a risky misconception. By understanding threats and respect impacts, organizations will be equipped to maintain confidentiality, availability and

Technology has facilitated the use of transiting data. With that in mind, sensitive information must be kept within close safe guards. Failure to protect vital information may facilitate its retrieval by criminals or those with malicious intents to use that data unethically. Individuals with access to material non-public information may sell that information to an outside party for profit. Likewise, these individuals may harvest this data within their perimeters to use as ammunition to defraud or blackmail an organization. Employers need to be wary of the threat of insiders exposing sensitive information to outside parties. “An insider is anyone who has intimate knowledge of internal operations and processes, or trusted access to

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

In today’s IT world every organization has a responsibility to protect the information and sensitive data they have. Protecting data is not only responsibility of security and IT staff but every individual is involved in protecting the information. The risks to information security are not digital only, but it involves technology, people and process that an organization may have. These threats may represent the problems that are associated to complex and expensive solution, but doing nothing about these risks is not the solution.

Statistics show that most security breaches are direct results of insider misconduct rather than being hacked. According to the most recent Verizon Data Breach Investigations Report, about “285 million records were compromised in 2008.” Seventy-four percent of the incidents were from inside sources. Users are more likely to be victims of computer virus infections, inquisitive students/co-workers, and hardware failures than to be victims of an Internet security attack.

WILLISON, R., & SIPONEN, M. (2009). Overcoming the insider: reducing employee computer crime through Situational Crime Prevention. Communications Of The ACM, 52(9),

The data breaches at Target, Home Depot are reminders to CIOs of how deadly social engineering can be. CIO’s and CSO’s realize the dangers of security problems on a massive scale. These are some deliberate security breaches that happen when an employee shares a password or loses a mobile device. An employee might access a website at work that loads malware onto his PC, which then spreads throughout the corporate network. In other cases, security breaches occur when a disgruntled employee leaves the company and takes with him valuable intellectual property that belongs to the company.

4. Security Awareness: A large percentage of successful attacks do not necessarily exploit technical vulnerabilities. Instead they rely on social engineering and people’s willingness to trust others. There are two extremes: either employees in an organization totally mistrust each other to such an extent that the sharing of data or information is nil; or, at the other end of the scale, you have total trust between all employees. In organizations neither approach is desirable. There has to be an element of trust throughout an organization but checks and balances are just as

Behavior in Organizations, 10th ed. Jerald Greenberg. Pearson/Prentice Hall (2011). ISBN 0-13-609019-2 or 978-0-13-609019-9 See the last page of the syllabus for how you can purchase the text as an ebook.

According to “How Much Does Cybercrime Cost?” in America, companies spend $1 billion every year, either trying to prevent future attacks or trying to recuperate from a previous attack. What does this money do if the real problem is based on a lack of awareness of their employees? And its not only small companies who are getting attack like previous years (greengard). Cybercriminals are now beginning to take the risk of attacking large companies because they contain more credit card information, money and information in general. Whether the company is large or small, they are still affected by insider threats. Insider threats are the largest problem among companies when it comes to cybercrime attacks; however, most don’t understand that there are many different ways to retrieve information from a company. They can use special malware, spyware or botnets, or wait for the employees to make a mistake. Some attacks are thoroughly planned and can take a while. Recently, Britain and American spies found their way into a company called Gemalto. (Alleged Hack). The lack of background checks and ability to suspect these spies lead to this breach. According to _____, conversations all over Australia were in put in danger because of the work of these spies. The hack affected millions of SIM cards which allowed outside sources to display any information that was on the phone. It even

Insider threats are considered as one of the most serious security problems in many studies and have received considerable attention among organizations over the world. This report will present the term “insider” and “insider threats” in cyber security, motives and effects of insider threats, underlying issues and causes of insider threats, prevention and detection of insider threats and management of insider threats within the organizations. The report will include case studies of malicious insider threats on IT sabotage and fraud as well as oblivious insider threats with analysis and discussions.

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

Regardless of the fact that they happen quite often, both internal and external security breaches are surprisingly unforeseen by many corporations. It is imperative that companies know how to go about dealing with one when a breach does occur. It seems that “the best approach to forensic response is to plan the response before an incident occurs” (Week 5 Lecture). There should be a way for employees to know how to handle a security breach and prevent future occurrences. Each individual company needs to have a standard operating procedure that discusses the processes for e-mail, acceptable use, physical security, and incident response.

One of the most important ways to protect your assets is to educate employees on personal security. Today’s attacks are much more sophisticated, and it is much easier to become a target of any number of scams which could leave the company at risk. These risks include user-level computer vulnerabilities and social engineering attacks.

The threat of insider threats within our company is made possible by emerging technologies. It is important that a security polices and training be required to assist in preventing these threats from occurring. Insider threats come from people who attempt to gain access to our systems in order to cause problems to our organization. It has been estimated that insider threats make up to 30% of all major security breaches. These threats include sabotage, theft, fraud, black mail, and violent actions. It is important to note people who commit such acts are normally former employees, current employees, and third party contractors. The following security proposal should be implemented with great hast due to the nature of our work overseas (Deloitte, 2016).