Ben Bulpett, EMEA Director, SailPoint, explores how organisations can safeguard against the insider threat.
Today, a job is no longer for life. Job hopping, second careers and the ‘portfolio’ career are all the rage. The average tenure for a job position in the UK is about five years.
In the US, it’s even shorter at four years, with public sector workers holding on to their jobs for longer than the private sector employees, on average.
Not only do we change jobs. We also work from a variety of locations, as over 60 per cent of global companies now allow remote working.
Many organisations boost their ranks with temporary workers, such as freelancers and contractors, to provide much-needed support during crunch times.
A Deloitte report found that 87 per cent of UK students with first or second-class degrees said freelancing is ‘highly attractive’ and a ‘lucrative’ career option. Over 53 million people in the US freelanced last year, with 1.4 million pursuing such activities in the UK.
Both of these trends are making digital access provisioning more complex. If businesses fail to adapt to the new employment landscape, they risk losing control of their cyber-attack perimeter as well as their corporate data.
What’s more, changing jobs or career is not just confined to business. Politicians have been known to jump ship and change allegiances as their part affiliations change.
More than 80 Members of Parliament (MPs) changed political parties in the last two years as Brexit arguments hotted up.
Handling job leavers is easy enough when the transition is smooth, and the departure is based on a mutual decision. However, some employees depart to join a competitor or as a result of their position being eliminated altogether.
Therefore, it’s worth ensuring that all staff can access corporate data in a timely and need-to-know basis, based on their identities.
Throw a disgruntled employee, who has an axe to grind, into the mix, and you have a recipe for disaster. As the saying goes, ‘revenge is a dish best served cold’ - unhappy ex-employees are getting more creative.
We’ve seen examples of sensitive corporate information or even renumeration records leaked via social media. Some newspaper headlines now read more like Hollywood movie plots, with recent leavers launching cyber-attacks on their former employers.
Today, companies are responsible for safeguarding their own data, as well as being compliant with privacy and compliance regulations related to customer data, such as GDPR.
Moreover, as the UK has officially entered the post-Brexit transition period, businesses have to decide whether they need to open new offices, relocate staff or hire more people in certain locations. This potentially increases the attack perimeter and thus the risk of data breaches.
Trust but verify
Research from Forrester shows that workers were responsible for 48 per cent of data breaches in 2019 – the ‘worst on record’ – and a big increase from 26 per cent in 2015. Yet, not all of the breaches can be attributed to ‘leavers.’
Many were accidental or the result of long-term employees breaking internal protocols. The Forrester study also shows that malicious insider threats contributed to more than seven billion exposed records globally in the last 18 months.
As more companies move their systems to the cloud with remote working on the rise – it is paramount to ensure that the right users have access to the right information, when, where and how they need it.
Identity is the best way to ensure it – and it doesn’t need to be restricted to human employees. It can include AI-led bots or even complex Internet of Things (IoT) systems.
More and more companies are looking into identity as the cornerstone of corporate security. Implementing a strong identity architecture provides increased visibility and control over data access in the organisation.
It helps bring peace of mind to those responsible for corporate performance and compliance. Meanwhile, staff feel empowered to do their jobs with the right level of access to information and in complete confidence.
Predictive Identity is a good platform towards supporting employees who may have unknowingly been hacked. Anyone can fall prey to a phishing attack or get their network compromised while using an unsecured WIFI connection while on the go.
Cloud changes the game
As more companies move their systems to the cloud, and with remote working on the rise – it is paramount to ensure that the right users have access to the right information, when they need it.
Identity is the best way to do it – and it doesn’t need to be restricted to human employees. In addition to permanent staff, contractors, sub-contractors, or freelancers, it can include AI-led bots or even complex IoT systems. Identity platforms can govern any person, object or code that interacts with company information.
As the attack perimeter becomes more complex and fluid, IT leaders are getting increasingly bogged down in administrative identity tasks.
These include access approvals, password resets, and compliance reviews – that can and should be automated with the use of Artificial Intelligence (AI) and Machine Learning (ML) technologies – in order to allow cyber security experts to focus on higher value jobs.
Unfortunately, almost half (48 per cent) of companies still have limited or no visibility into who is accessing their corporate data. Yet identity has never been as strategically important to a company’s success. It has to be a board level priority for any business to get their identity systems right.
Our vision is for identity to be at the heart of cybersecurity and compliance risk assessment and monitoring today and in the future.
As part of the next generation compliance and corporate governance, identity platforms will provide companies with risk-based alerting capabilities. It will help detect suspicious or anomalous activities and stay informed of potential threats in real-time.
Prevention is always better than cure. The next decade will see identity becoming a vital component of cyber security ‘defences’ for any responsible and fast-growing business in the modern working environment – irrespective of size or complexity.