Tracking cyber threats and taking preemptive measures can be very useful for defending against hackers, but identifying insider threats that cause these attacks can take the preemptive game to the next level. This is why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is calling on infrastructure operators to re-strategize on how to deal with compromises from within in the ever-growing cyber landscape.
What is an insider threat, and why does it matter?
According to CISA, insiders pose a threat to the integrity, confidentiality, and availability of all critical infrastructure and critical systems that manage different aspects of our daily life, including how things are done, where you find confidential information, and so on. The impact of disrupting critical infrastructure can be wide-ranging and ultimately significantly disrupt the functioning of our society.
An insider threat exists when a person who already has trusted access to an organization’s systems, buildings, or information, such as an employee, takes an action that causes harm to that organization through either malicious intent (e.g., theft of data or sabotage of network) or an unintentional act (e.g., accidentally clicking on a malicious web link that gives attackers access to your organization). Insider threats can be difficult to detect due to their deceptive nature.
The example above describes how a wolf can appear to be just another sheep in a flock; therefore, no alarm will go off, and there will be no loud footsteps from the “wolf” as he approaches the flock; however, there is much hidden danger in this situation.
CISA’s new guidance: Strengthening cybersecurity across the Nation through clear, actionable standards
To assist businesses in protecting these important resources, CISA has just launched brand-new materials and recommendations to assist with safeguarding themselves from insider threats. Among these resources is the POEM framework, which represents the four areas that aid in the prevention, observation, evaluation, and management of insider threats before they escalate into larger issues for organizations, as the agency flags major cyber risks after a cyber attack.
The focus of the guidance is on creating a multidisciplinary insider threat management team. This team is made up of individuals from various functions within your organization (security personnel, human resources, legal, operational managers, etc.) and works collaboratively to identify early signs of insider threats, investigate concerns, and respond quickly to issues when they arise. The goal of working as a team is to provide a better chance of identifying potential insider threat issues before they escalate into problems.
How insider threats can sneak in and cause danger
Unlike a burglar, who typically bursts through the front door, the existence of an insider threat will be much less obvious because this person has access to the workplace. A good example would be an employee who accidentally clicks on a link from a phishing website, allowing attackers to gain access. A disgruntled employee may also obtain sensitive information and leak it to the public at some point in time, as the U.S. intelligence agency issues new security guidance.
Why this matters to everyone: Protecting our digital lives together
Many people assume that insider threats only exist for large tech companies or energy companies; this assumption is incorrect. Critical infrastructure affects us all; if a power grid fails, then hospitals will stop receiving power.
The same can be said of our water system; if it is compromised, we will no longer have access to clean water and nothing else. It is believed that this is why CISA likes to encourage stronger defenses, because it impacts everyone’s lives, whether they know it or not.
The chances of a successful cyberattack increase exponentially with insider assistance. This is why the efforts of CISA not only target the direct cause but also promote decisive action against eventual compromise that could lead to a cascade of cyber disasters, as the agency sunsets 10 emergency cyber directives. In the current digital landscape, taking these kinds of measures is not only mandatory, but it is the only way to annihilate the existential threat to cyber infrastructure.
