Get All Access for $5/mo

A Facebook Engineer Stalked Female Users. A Dentist's Receptionist Stole Patients' Identities. Here's How to Prevent These Things From Happening at Your Company. Malicious insiders are the most dangerous security risk of all.

By Larry Johnson Edited by Dan Bova

Opinions expressed by Entrepreneur contributors are their own.

Focus Stock Fotografico | Getty Images

A major risk to businesses is one that they often overlook -- rogue employees, also known as the "insider threat."

Related: No One Is Safe From the Data Breach Epidemic (Infographic)

While many companies today are devoting more resources to preventing hackers from stealing sensitive information, rogue employees can pose a far more serious risk because they have inside access to company secrets, clients and technologies, and they are often not sufficiently monitored. According to the Ponemon Institute, the cost of an insider-related incident is actually higher than a data breach caused by an outside hacker - $4.3 million per incident versus $3.62 million, respectively, and these costs could exceed $8 million over a 12-month period.

Insider threats are also on the rise. A 2018 report by the Ponemon Institute found that malicious insider incidents have grown by 56 percent since 2016.

A quick scan of the news on any given week will show how prevalent these cases are. For instance, in a recent case at Facebook, a security engineer was accused of abusing his privileged access to stalk women online. In January, a Chinese company was found guilty of using an AMSC employee to steal $800 million worth of intellectual property from that company. In April, a former Manhattan dental office receptionist was convicted of stealing the identities of over 650 patients. And the list goes on and on.

Related: Passwords Are Scarily Insecure. Here Are a Few Safer Alternatives.

Yet, in spite of the risks, many companies remain unprepared. Nearly one-third of companies admit they have no ability to prevent or deter an insider attack, and only 9 percent consider their insider prevention measures to be effective, according to a 2015 study by the SANS Institute.

Preventing this type of abuse isn't easy, but it can be done.

Here are four ways to manage the risk posed by trusted insiders.

Access controls

The key to reducing a company's exposure to insider threats is by creating strong "access controls" that prevent how much data a single employee is able to freely access in the first place.

No single employee should have unfettered access to all of the company's secrets -- rather, sensitive data should be siloed, and employee access should be decided on a case by case basis, determined by the employee's need to access such data in order to fulfill her duties. For example, a sales manager does not need access to the company's intellectual property, and an IT administrator does not need access to the company's client roster. The separate roles within a company should also be separated by the level of data access they have.

Related: Making Your Data Unreadable to Whoever Steals It Might Be the Only Way to Keep It Safe

Technical controls

In addition to establishing policy controls on data access, a company should also have in place strong technical controls that prevent over-access or abuse by insiders.

These controls should include: encrypting highly sensitive data, so that only specific people can access it; blocking or restricting certain types of tools and websites from employee devices, such as Tor, file transfer protocol (FTP) services, etc.; restricting the use of remote logins to the company's network; resetting passwords immediately for any terminated employee; and requiring regular password resets for all employee accounts in order to reduce the likelihood of learned or shared passwords.

Mobile device management

This is another crucial step, particularly in today's highly mobile and bring-your-own-device business world. A mobile device management (MDM) service enables a company to monitor the content on both company-owned and personally owned devices, as well as to containerize company data and allow for remote wiping if needed.

Related: Why This Cybersecurity Expert Wants You to Rethink What You Keep Secret

Monitoring

There are many different tools available for keeping an eye on employees, ranging from all-inclusive Big Brother-style technologies that monitor all employee activity on devices (such as email, social media, web browsing, etc.) to more focused tools like exfiltration monitoring, which only look for files being transmitted from the company network to a remote IP address.

However, it's important for companies to not be too heavy-handed with employee monitoring, or it could backfire. If employees feel they aren't trusted or valued by the company, they could act out -- the exact thing the company is trying to avoid in the first place.

It is best to take a more moderate approach with monitoring, by focusing on what really matters. Exfiltration monitoring, file access monitoring (who is accessing important files, and when and where) and email monitoring are three good steps to take.

Related: What You Need to Know About Multifactor Authentication

While there is no way to completely eliminate the insider threat, by taking a few key steps, companies can drastically lower their risk and keep employees in check. For more on this issue, see the FBI's tip sheet on averting the insider threat.

Larry Johnson

Chief Strategy Officer at CyberSponse

Larry Johnson is chief strategy officer of CyberSponse, a Washington, D.C.-based cyber incident response company serving Fortune 500s and government agencies. He is a 24-year veteran of the Secret Service, where he served as a high ranking supervisor at the Presidential Protection Division as well as special-agent-in-charge of its Criminal Investigative Division. He is also a former chief security officer (CSO) at a Fortune 250 company and a recipient of the International Association of Credit Card Investigators' Police Officer of the Year award and the 9-11 President's Distinguished Service Award.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick

Marketing

9 Key Tips to Help You Get the Most Out of Your Link-Building Efforts

Here's a quick guide that will help you identify the scams and get the best value for your money.

Business News

Daniel Lubetzky Took Kind Snacks From Idea to $5 Billion. Here's His Best Advice For Anyone Who Wants to Start a Business.

In an interview with Entrepreneur, Kind Snacks founder Daniel Lubetzky tells aspiring business owners not to follow someone else's path to success — even his.

Business News

JPMorgan Chase CEO Jamie Dimon Isn't Worried About AI Taking Over Jobs — Here's Why

Dimon said AI was part of the next wave of tech innovation.

Growing a Business

How to Build Effective Collaborative Business Relationships — Your Step-by-Step Guide

Use this structured framework to form successful partnerships, manage risks and create lasting value for all stakeholders involved.

Marketing

Free Webinar | November 20: How to Avoid 3 Costly and Common Marketing Mistakes

Join our webinar on 11/20 with author and business coach Darcy Juarez to learn simple, budget-friendly marketing strategies that will attract clients and grow your business fast. Register now!

Business Plans

How to Master Your Strategic Planning As You Prepare Your Business for 2025

Here's how to best think about strategic planning, communication rhythms and maintaining alignment for consistent growth as you plan for next year.