Insider vs outsider threat: Which is the greater risk?
Posted: 21st May 2024 - Reading Time: 2 minutes
Cyber threats can originate internally or externally within an organisation, each posing distinct risks and motivations for attackers.
External attacks are typically deliberate and often driven by financial gain. However, motivations can vary widely across different industries. For instance, attacks on businesses may also aim to make social or political statements through hacktivism, conduct espionage to gain competitive advantage, or simply challenge cyber security measures (known as ‘white hat’ hacking).
Healthcare providers are frequently targeted to steal valuable medical and personal data, which can be sold on the dark web or used for unauthorised medical access or prescription drug fraud. Similarly, food service, accommodation, and retail sectors are prime targets for obtaining customer payment information, such as credit card details, for identity theft or fraudulent purchases. Attacks on financial services often seek sensitive banking and credit card information for financial gain.
Public administration bodies are vulnerable to data breaches where attackers aim to steal confidential government records, which may be sold to foreign entities or used for political purposes. Hacktivists also pose a threat, aiming to make political or social statements or demonstrate technical prowess through disruptive cyber activities.
Internal attacks, on the other hand, frequently involve employees with privileged access seeking financial gain or motivated by revenge due to perceived grievances. For example, disgruntled employees in system administration roles may exploit their access to steal and sell sensitive data. Others may inadvertently open backdoors into systems or networks, either through negligence or social engineering tactics like phishing. In 2014, a former senior internal auditor at Morrisons, Andrew Skelton, leaked personal data of nearly 100,000 employees, including names, addresses, bank account details, and salaries. Skelton was subsequently sentenced to eight years in prison for his actions, which were described as an act of revenge following a disciplinary issue.
Many internal incidents occur due to unintentional actions, such as downloading malware or leaking information unknowingly. These errors often stem from outdated software, inadequate patch management, or insufficient employee awareness training on cybersecurity best practices.
Understanding these varied motivations and tactics is crucial for organisations to implement comprehensive cybersecurity strategies that address both external threats and internal vulnerabilities effectively. By bolstering security protocols, enhancing employee awareness, and adopting proactive monitoring measures, businesses can mitigate risks and safeguard against the evolving landscape of cyber threats.
About the Author
