Snapshot Of Insider Threats Within Government

Insiders have a significant advantage over external attackers. This is because not only they are aware of the organisation policies, procedures and technology, but they are also often aware of the vulnerabilities.

Insider incidents are inevitable, and at some point, your organisation is likely to be compromised.

While this is unfortunate, it is a reality that must be proactively prepared for if your organisation is to withstand such threats.

Remember, there is no silver bullet in preventing insider threats. Having too many security restrictions can impede an organisation mission, and having too few may permit a security breach.

Fraud Snapshot Analysis

Around 61% of incidents impacting federal organisations involved Fraud. It included issues of fraud, waste, and mismanagement of federal funds.

• Who?
  • 45.8% of insiders were worked with the organisation for five years or more
  • 69.4% of insiders had an authorised account, and data
  • 89.5% were full-time employees.
• What?
  • 52.2% of the targets in Fraud incidents were related to personally identifiable information.
• When?
  • For incidents where the attack was known (27), all involved during business hours. Half of these also involved activity outside work hours. No fraud activities were determined that only took place outside of work hours.
• Where?
  • Around 97.6% of incidents took place on-site when attack location was known (41);
• Why?
  • Around 97.8% committed insider Fraud because their motivation was financial gain.

As mentioned, the second most observed Insider Threat incident with Federal Government was “Other Misuse”.

Other Misuse by insiders can be described as those incidents that involve the unauthorised use of organisational devices, networks, and resources that are not better classified as Theft of IP, IT Sabotage, or Fraud.

Examples of Other Misuse include the use of organisational resources for personal benefit (e.g. obtaining access to colleagues’ emails without consent or a proper business purpose) or committing another kind of cyber-related crime (e.g. stalking or purchasing drugs), which in turn violate organisational policies.

Further Analysis

Insiders committing Fraud in Government tended to be in trusted positions and committed the incident during working hours.

The median financial impact was between $75,712 and $317,551, and three fraud incidents had a financial impact greater than $1 million or more.

Final Thoughts

Insiders who commit fraud are usually low-level employees who use authorised access during regular business hours to either steal information or modify information for financial gain. Insider fraud crimes are often long and ongoing and are bad news for the actual organisation.

Stolen information is usually Personable Identifiable Information (PII) such as payroll or other sensitive information, which is then sold to outsiders who commit the actual fraud against the organisation.

Perhaps the most notable feature of insider incidents within the Government was how prevalent incidents of Other Misuse. It is most likely that insiders that committed Other Misuse generally did so in furtherance of an additional crime.

Suggested Mitigation Strategies

• Mitigation protection for fraud-related crimes starts with better screening and identification of employees at hiring.
• Some insiders accumulate excessive privileges that enable them to carry out their crimes. It is therefore essential that you carefully control and audit roles.
• If possible, enforce separation of duties with all of your critical processes.
• A monitoring strategy for fraud should include monitoring access and data modification. May also include frequent random auditing on critical information fields.
• Utilise user activity monitoring solutions to identify user activities that can be used to detect fraudulent activities.
• Encourage employees to recognise and report suspicious behaviour, including outside facilitation.
• Develop an employee assistance program that includes financial counselling.

 Need Help?

Are you experiencing an insider threat situation right now and not sure how to address it?

Are you interested in standing up an insider threat program?

If so, here is a simple two-step process for you to follow:

1. Download the following article – “How To Develop An Insider Risk Mitigation Program In 7 Steps” – https://www.nakedinsider.com/InsiderRiskMitigationStrategy
2. Please schedule a time to discuss your requirement.
   1. You can either call us on +61 2 6282 5554 or alternately or
   2. visit the Naked Insider website nakedinsider.comand leave your details so that we can follow up with you afterwards.