Insider threats can be especially unpredictable for security teams to deal with, as perpetrators might already have access to organizational resources that are not available to the general public. ISACA’s new white paper, A Holistic Approach to Mitigating Harm From Insider Threats, gives enterprises a proactive approach to reducing and mitigating risks associated with insider threats.
The white paper helps professionals to determine the difference between malicious and malignant insider threats, while introducing a new approach to user-initiated loss and providing context around human security engineering. It also outlines the following types of insider threats that companies must keep in mind:
- Well-meaning employees
- Outsiders become insiders
- Malicious employees
- Contractors
- Vendors
- Customers
The white paper also details several ways to mitigate insider threats:
- Reducing data access by limiting individual permissions to sensitive data. When access is limited, the compromise of data becomes less likely because fewer people are in a position to compromise that data.
- Considering the damage that phishing and ransomware cause. Filtering emails prevent phishing messages from transferring sensitive information to the hands of an insider.
- Introducing controls around the insider (technical, operational or physical). These controls lessen the opportunity for the insider to inflict damage.
- Applying human security engineering principles. This reduces the likelihood of users being in a position to initiate a loss.
A Holistic Approach to Mitigating Harm from Insider Threats is available as a free download here. For additional insights into IT risk, including ISACA’s complimentary Risk IT Framework and the Risk IT Practitioner Guide, visit www.isaca.org/resources/it-risk.