Insider Risk in a Post-Pandemic World

Employees have this sense of data entitlement. When it comes to how they handle data, and the types of data that they might take from one job to the next. There's just this notion that it's okay to do this. The challenges with security is that this is really kind of a weak area. From an enforcement perspective, the departing employee is oftentimes one of the weakest experiences. That’s because it's so common that we see data moving out, when you also take into consideration some of the dynamic changes that we're dealing with from work from home, there's a greater opportunity for employees to put data at risk accidentally or unintentionally.

Tommy Todd

Vice President, Security, Code42

The COVID-19 pandemic changed almost every facet of life and cybersecurity was no different. As employees were forced to work from home, companies and government agencies had to expand their IT infrastructure to accommodate.

While that was a comfort for some, it also increased risk in networks, especially from insider threats, according to Tommy Todd, vice president of security at Code42 during a discussion sponsored by Code42.

“Employees have this sense of data entitlement,” Todd said. “When it comes to how they handle data, and the types of data that they might take from one job to the next. There’s just this notion that it’s okay to do this. The challenges with security is that this is really kind of a weak area. From an enforcement perspective, the departing employee is oftentimes one of the weakest experiences. That’s because it’s so common that we see data moving out, when you also take into consideration some of the dynamic changes that we’re dealing with from work from home, there’s a greater opportunity for employees to put data at risk accidentally or unintentionally.”

It’s not just insider risk that is a higher risk during the coronavirus, though.

Todd said security managers need to take into account how employees work differently in a post-pandemic world.

Employees want to be able to work on their own times and in their own locations. That means they may be going to cafes, working odd hours or using networks that are not sanctioned.

“These devices become communal in nature, because the whole family is sharing the same space as the employee,” Todd said. “There’s a potential for personal activity by unauthorized users to occur on these devices. We talk about being prone to mistakes, they’re just one click away from potentially putting data at risk.”

Employees are constantly sharing data via email, programs, the cloud and other measures.

“As a result of that, we need to make sure that we have the proper level education on how to use these tools correctly, so that we’re not unintentionally oversharing, we also need to have security teams that have the right level of visibility on how data is being handled by these employees in this remote location,” Todd said. “One of the challenges that we see is that the perimeter has practically evaporated. As a result of that our traditional data protection strategies no longer apply, we have to think about it differently. Tt’s really caused a lot of organizations to rethink how they look at data protection.”

Todd says the government and companies will need to constantly evolve as the threats continue to evolve as well. Using tactics like zero trust, which limits access privileges to those who truly need them.

Todd said the White House recently issued an executive order that requires the government to look into its use of data too.

“They’re really trying to figure out the relation between the data and the way the data moves,” Todd said. “The White House wants to try to make sure that data is not inappropriately exposed. We think about some of the more high profile attacks that have happened recently, a lot of this was more about surveillance attacks, just being aware of what’s going on in the environment.”

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.