Could BYOD Increase Insider Threats?

Five Tips for Overcoming Mobile Security Challenges

A new study commissioned by Raytheon and conducted by the Ponemon Institute provides a fresh look at the insider threat. In a nutshell, we can expect the insider threat to increase. According to FierceMobileIT:

Focusing on ‘the human factor,’ the survey report, “Privileged User Abuse & The Insider Threat” finds that many individuals with the highest levels of network access in organizations are often granted access to data and areas of the network not necessary for their roles and responsibilities. The report reveals that 65 percent of survey respondents indicated that curiosity – not job necessity – drives these same individuals to access sensitive or confidential data.

One finding I found interesting was that 47 percent of those surveyed believe that the malicious insiders will use social engineering to gain someone else’s access rights. We think of social engineering as an outside tool, something that cybercriminals use in phishing emails or bogus social media posts to gather credentials. But apparently, if the insider wants the information bad enough, he will use any means to get it, even if it means specifically targeting co-workers.

Making the situation worse is that while the vast majority realizes that they need to do something more about insider threat security, less than half have a security budget dedicated to protect the network from insiders.

Another question that this survey raises concerns BYOD and insider threats. Could the use of BYOD increase the potential of insider threats? Inside Counsel says it very well could:

But while BYOD programs have been implemented with much zeal, there are still some risks associated with them that must be considered, perhaps most alarming is the possibility of employee espionage that they could facilitate.

… Any situation that allows an employee to connect to an organization’s server using a device of their own opens up the possibility for the theft of sensitive information.

We already know that in many companies, good BYOD security policies are lacking, so even honest employees have too many opportunities to go rogue, intentionally or by accident. To add complication, most employers don’t realize that their networks have been breached by an insider (or anyone, for that matter) until it’s too late.

As Jack Harrington, vice president of Cybersecurity and Special Missions with Raytheon Intelligence Information and Services was quoted in FierceMobileIT:

The results of this survey should serve as a wakeup call to every executive with responsibility for protecting company or customer sensitive data. While the problem is acutely understood, the solutions are not.