Internal Security Threat Regarding Employees

Security and ethical employees will continue to be a vital aspect of ensuring the success of an organization. There will always be a need for ethical IT security professional as hackers will continue to force organizations to make adjustments in their business models to protect their employees, data and customers. Many organizations and managers believe application security requires simply installing a perimeter firewall, or taking a few configuration measures to prevent applications or operating systems from being attacked. This is a risky misconception. By understanding threats and respect impacts, organizations will be equipped to maintain confidentiality, availability and

Technology has facilitated the use of transiting data. With that in mind, sensitive information must be kept within close safe guards. Failure to protect vital information may facilitate its retrieval by criminals or those with malicious intents to use that data unethically. Individuals with access to material non-public information may sell that information to an outside party for profit. Likewise, these individuals may harvest this data within their perimeters to use as ammunition to defraud or blackmail an organization. Employers need to be wary of the threat of insiders exposing sensitive information to outside parties. “An insider is anyone who has intimate knowledge of internal operations and processes, or trusted access to

The first of these threats is Social Engineering. Social Engineering according to Social-Engineer.org (2013), is “the act of influencing a person to accomplish goals that may or may not be in the ‘target’s’ best interest. This may include obtaining information, gaining access, or getting the target to take certain action.” The employees themselves are the area of the system affected by this threat. Social Engineering exploits their naivety. General lack of experience in recognizing this type of attack is a major reason for its success. Education on what Social Engineering is and how to recognize attacks coupled with company policies written, put into place, and enforced to prevent individuals from divulging or even having access to certain information no matter the scenario is the recommended course of action.

WILLISON, R., & SIPONEN, M. (2009). Overcoming the insider: reducing employee computer crime through Situational Crime Prevention. Communications Of The ACM, 52(9),

8. Which domain requires annual security awareness training and employee background checks for sensitive positions to help mitigate risks from employee sabotage?

The data breaches at Target, Home Depot are reminders to CIOs of how deadly social engineering can be. CIO’s and CSO’s realize the dangers of security problems on a massive scale. These are some deliberate security breaches that happen when an employee shares a password or loses a mobile device. An employee might access a website at work that loads malware onto his PC, which then spreads throughout the corporate network. In other cases, security breaches occur when a disgruntled employee leaves the company and takes with him valuable intellectual property that belongs to the company.

Insiders represent the greatest threat to any information systems. The majorities of insiders have the proper security clearances, have signed the non-disclosure agreement, are firmly loyal to the United States, and know that they are obligated to protect the nation's secrets and sensitive information. The insiders are granted certain authorities and trust and have the ability to abuse their authorized access to exploit or otherwise misuse information systems. Imagine a federal employee is disdained of security practices that result in compromise or destruction of information. An example would be the recent top secret documents leaks that were stored in Secretary of State Hillary Clinton’s private unsecured server. According to recent news, there were at least 1,340 classified emails ranging from classification level of secret and top secret found in United States Hillary Clinton’s server. Another example would be the case of former CIA Director David Petraeus where he was prosecuted for intentionally sharing intelligence from special access programs with his formal biographer Paula Broadwell. For the federal department, unauthorized disclosure of classified materials could cause

Network intrusion may be a difficult task to complete with advances in network security, but with evolving technology and the availability of information on the Internet, network intrusion prevention may be the harder task. It was mentioned above that one must get to know his enemy before the attack; the same can be said if the roles are switched and one is on the defense. To obtain and maintain network security, motives for network intrusion must be analyzed. Take for example the attack that was conducted on the Office of Personnel Management which acts as the United States Government 's Human Resources department. On June 4th, 2015, the Office of Personnel Management disclosed a statement saying “Personnel data, including personally

Insider threats are not a new phenomenon in the history of the world or the United States. Sun Tzu, the famous Chinese General and author of the famous treatise The Art of War, believed that obtaining information through the use of spies made certain “great achievements.” The use of spies continued in from the Roman Empire to the strategic victories in World War II (Zurcher, 2013). In the United States, the mainstream media popularized spying with figures like James Bond, Jack Ryan, and Simon Templar. During the Cold War, 1985 was dubbed the “Year of the Spy” when twelve individuals were arrested by the Federal Bureau of Investigation (FBI) for spying. John Anthony Walker Jr., a Navy Warrant Officer and communications specialist worked for the Soviet Union; Jonathan Pollard, a civilian intelligence analyst for the Navy’s Anti-Terrorist Alert Center worked for Israel; Sharon Scranage, Central Intelligence Agency (CIA) desk clerk in Ghana and worked for Ghana; Larry Chin, a Chinese language translator/intelligence officer for the CIA worked for China; and Ronald Pelton, a communications specialist for the National Security Agency (NSA) worked for the Soviet Union; are a few examples of the individuals arrested (Federal Bureau of Investigation, n.d.). Each of these individuals worked within the US Defense and Intelligence communities and exposed national security secrets.

There are other identifiers of potential workplace violence such as: an individual who have difficulty getting along with others, making inappropriate remarks, always upset about everything and everyone. Also, there are individual who the company and employee have no clue about because the perpetrator is an outsider, not an employee of the organization. In this incidence, it is quite difficult to identify the potential threat. Therefore, the organization must have a program in place to handle offsite threats that may invade the company and cause violence and/or harm to its employees. The program(s) designed within that particular organization will better assist that company in the scope of recognizing and avoid potential workplace violence occurrences.

Below the top leadership of an organization comes a body of supervisors who deal with employees on a daily basis. Similar to the management situation, if supervisors are more engaged with employees when it comes to information security, employees are likely to comply with the guidelines regulating information within the organization (Chen, Ramamurthy, Wen, 2012).

Companies and Corporations are also at risk from insider threats. A careless or disgruntled employee is capable of divulging confidential or secrete information, faster than any outside threat or hacker, if

During an initial review of data for Jacket-X from last year, several potential threats and vulnerabilities were identified. Specifically, the payroll business process was highlighted as containing threats and vulnerabilities requiring immediate attention from management in order to prevent a data breach. Recall threats and vulnerabilities, although often utilized together in discussing cybersecurity risks, are two separate concepts. To review, a threat is defined as an undesirable event that can cause harm”. It is also important to note that threats can be internal or external to an organization (Valacich). Alternately, a vulnerability is defined as a “weakness in an organization’s systems or security policies that

There are two types of vulnerabilities we face at our company today, technical and administrative vulnerabilities. Technical vulnerabilities consist of improper configuration of software and hardware, a lack of advanced security software and vulnerable

In the InfoSec industry, CTOs have witnessed many inside jobs also known as insider threats. These threats usually comprise of individuals or groups of people in organizations or companies. These individuals may include employees, contractors, business associates or partners. They try to deliberately contribute to or begin to breach the network of the company to sabotage or steal information. Because these people are already inside the company, they have the advantage of being familiar with how the network works in the company, having login credentials, having ways to keep their position in the company without getting caught and being able to access information about clients. These insider