Data Breach Caused by an Employee

You’ve just sat down to start your work day and you’re going through your emails, hot cup of coffee in hand. You see an email from your company’s IT department telling you to install an update ASAP. As soon as you click the link in the email, you realize you probably should have checked with IT first. Questions start racing through your mind: “Did this email come from them?” “What did I just do?” “Will I ever be able to enjoy a cup of coffee again?” According to a recent study, there was a 61% increase in the rate of phishing attacks in the six months ending in October 2022 compared to the previous year. The same study also revealed a 50% increase in attacks on mobile devices. With the number of cyberattacks on the rise, organizations are becoming increasingly vulnerable; this vulnerability can contribute to a lack of customer confidence. A 2022 PWC survey found that 87% of business leaders believe consumers highly trust their company, but in the same survey, only 30% of consumers said they actually trust companies. For companies to get their consumers to trust them, they must first trust their employees. When a cyber event occurs, employees must feel empowered to act quickly to prevent further damage–this means being equipped with the best cybersecurity resources to stay prepared.

5 essential steps to protect your organization from a data breach

Though most organizations have an incident response plan in place for this exact contingency, when a data breach does occur, employees are often the first line of defense. Whether it was an insider who stole customer data, a ransomware attack, or an accidental breach, the National Institute of Standards and Technology (NIST) has a useful cybersecurity framework to follow in the event of a breach:

1. Identify

Identify and gather all critical assets, including systems, people, data, and capabilities. This will help gain an understanding of how these assets support critical functions in the business context of an organization.

2. Protect

This function supports the implementation of security measures to prevent or limit the impact of a cyber incident on critical assets. Some of the most important measures are:

Stricter Access Control and Identity Management
Staff training to raise awareness about cyber risks
Securing data by protecting its confidentiality, integrity, and availability

3. Detect

Being able to quickly detect a cyber incident is vital in minimizing its consequences. Organizations must be able to detect system anomalies through continuous monitoring and other processes. Defense teams should be able to gather and analyze data from different sources. A good system to weed out false positives is critical for the detection process.

4. Respond

Having an Incident Response plan is only the first step. Security leaders must ensure that the plan is executed during and after an incident. Clear communication between internal and external stakeholders and law enforcement is necessary for effective response. A response plan should also have mitigation activities to resolve an incident and prevent its expansion.

5. Recover

The recovery phase is when affected systems and their capabilities are restored. Having a recovery plan in place can help organizations find various “what if” scenarios and come up with a plan for handling cyber incidents. Learning from the mistakes of others is also a great place to start. NIST’s Guide for Cybersecurity Event Recovery outlines the recovery planning process and the essential items that should be included in the recovery playbook.

Don’t forget empathy

There is never one factor that causes a breach; in most cases there are a variety of elements that contributed. While many people’s first thoughts jump to the IT department when a data breach or cybersecurity event happens, the truth is that it’s the job of everyone in an organization to prevent these from happening. And in the case of insider threats, where data was unintentionally shared by someone from within the organization, it takes a degree of empathy to understand and move on from the event. According to Gartner, 50% of insider incidents are non-malicious, which means that the employee who caused the breach made a mistake during the course of their work day. Treating this person with respect—without the cloud of judgment hovering over them—can improve their chances of learning from the incident and repeating the same mistake again.

5 ways to prevent a future data breach

To maintain customer trust, and avoid both financial and reputational damage, taking preventative steps and following incident response best practices can go a long way to keeping a company secure. Making these five elements part of daily life will serve to improve security for not only employees but for the organization as a whole:

Keep all software and hardware up to date

Turn on automatic software updates, and keep browser plug-ins up-to-date.

Be cautious with mobile devices

We’ve all come to rely on our devices to do pretty much everything for us, but they need to be managed properly. Add a password, don’t leave them unattended, and avoid clicking on links from unknown numbers.

Avoid social engineering schemes, such as phishing and malware

Stay apprised of the latest tactics used by threat actors by attending company-wide security training.

Employ Multi-factor authentication (MFA)

This security measure requires users to provide two or more pieces of evidence to gain access to a resource (like an application, website, or VPN).

Manage passwords responsibly

With so many passwords to contend with these days, it can be tempting to reuse the same one for multiple, if not all, sites. Employing a program that manages passwords can take the risk and confusion out of the picture.

Data breach prevention with SecurityScorecard

SecurityScorecard Cyber Resilience Services enable businesses to take immediate action toward identifying, resolving, and mitigating future risks. With SecurityScorecard, your business can take advantage of our 24/7 services where we will find the root cause and eliminate it. From there, our digital forensics team discovers all compromised information, giving you the information you need to take the necessary next steps. The sooner an incident is reported, the better. Learn how SecurityScorecard can help you respond to future threats and talk to an expert today. And get back to enjoying that hot cup of coffee.