How the ‘Cookie Monster cat’ exposed the accidental insider threat

A recent email mistake at the U.S. embassy in Australia exposed the growing threat of the "accidental insider."

As part of a training session, an embassy employee accidentally sent a party invitation to a "cat pajama party." Featuring a picture of a cat in a Cookie Monster costume, the email went to an undisclosed number of people.

While many embassies in the region had good-natured fun responding to the party invitation, this scenario is a perfect example of how people making mistakes can, at best, be a bit of an embarrassment and, at worst, expose sensitive or classified data. What if the email contained information on embassy security practices or personal information on embassy staff and employees?

We actually know the answer to this "what if," as four of the 10 biggest U.S. government data breaches of all time were caused by the accidental insider.

Accidental insiders and the growth of unstructured data

Data breaches from accidental losses grew by close to 580 percent from 2016 to 2017. More than 2 billion records were lost during this period -- more than occurred from any other cause, including external attackers.

One of the biggest contributing factors to the growth of unintentional data breaches is the rise of unstructured data. More than 80 percent of all enterprise data is considered unstructured, and this amount is growing daily.

Unstructured data is represented by the hundreds of PDFs, PowerPoints, videos, emails, Word docs, spreadsheets and other files that an employee is likely to interact with or create. Unstructured data can also be generated when a person extracts structured data from a system or database and puts that information into an application, such as exporting client account details into Excel.  

This data poses a much higher risk to organizations, as it is inherently less secure and much harder to control than structured data,  primarily because the files and applications built for unstructured data were created for extreme ease of use and specifically for sharing.

To compound the issue, unstructured data is typically spread throughout an organization -- existing almost everywhere someone creates or saves content. It is typically propagated across laptops, mobile devices and more, creating a broad spectrum of risk. 

Finally, unstructured does not equate to "innocuous." Whether it’s budgetary information, security procedures or classified client documents of a more sensitive nature, these files are often shared across insecure channels like email. 

The growth of unstructured data, combined with the proliferation of mobile devices and cloud services that make sharing incredibly easy, has helped drive a dramatic increase in accidental breaches. In a world of real adversaries and malicious attackers, government can no longer live with the unforced errors of the unintentional insider. 

Here are four ways agencies can  prevent the next unintentional breach of sensitive data:

1. Deploy intelligent email encryption that’s usable. One of the biggest problems with security tools that protect unstructured data is that they’ve traditionally been too hard to use. Email encryption and similar services typically have been in the domain of the sophisticated user and require extensive training. However, when security software impedes productivity, employees tend not to use it at all.

Email encryption services should be integrated into existing email platforms and should be useable by the average employee. If it takes more than two steps to send or receive an encrypted email, chances are it won’t be used. The same concept applies to encrypting files and documents to prevent breaches in the case of lost devices.

2. Automate human error reduction. Managing the risk of error means eliminating it before it happens. Behavioral technology has been used in email for years -- often in the form of features such as auto insert for email addresses, where Outlook guesses the intended recipient of an email. This is a recipe for disaster when dealing with sensitive information, as auto insert is a leading cause of the accidental email.

Fortunately, behavioral technology and artificial intelligence are now being used to do the opposite as well -- predicting when an email or recipient is anomalous and stopping the email from being sent. Automation can take error-reduction tasks out of the hands of the most error prone.

3. Manage IT and collaboration services. Shadow IT generally refers to employees' use of IT solutions and systems inside an organization without the express approval of the IT department. As a result, there is little oversight and often no security on these applications.

Cloud file-sharing applications can be powerful, but also create a security nightmare if they’re not managed by IT. While shadow IT can be incredibly hard to manage and prevent, organizations can embed security on the data and files themselves.

Concepts such as limiting the time for document sharing, preventing downloads and edits, revoking recipient access and enforcing multifactor authentication help the user stay in control of information, even in the event of an accident.

4. Hit the audit trail. Discovery and classification of unstructured data is critical to starting and building an ongoing audit trail of the flow of sensitive data inside and outside an organization. Knowing when an encrypted message is sent, when a file is opened or uploaded, and by whom is critical for maintaining fidelity of data, but also in staying ahead of compliance requirements.

Accidents happen, but the growth of unstructured data means that accidents can hurt an organization much more than intentional data misuse. As we continue to build stronger protections against malicious attackers and insiders, it’s imperative government organizations stop accidents from becoming the next great breach of sensitive data.

So, the next time you’re emailing a citizen’s personally identifiable information, sharing details of licenses for state professionals or sending information related to legal procedures, think about the inherent risks this unstructured data represents. Then consider why being able to do these tasks quickly and securely -- without the risk of errors turning it into a career-limiting action -- would make sharing and collaboration an even bigger productivity driver.