Cybersecurity should be a priority for organizations looking to leverage various forms of advancing technologies. Surprisingly, most companies fail to implement even the basic cybersecurity policies, leaving their employees and businesses exposed to cyberattacks. This explains the recent surge in cyberattacks, especially Distributed Denial of Service attacks that shut down several sites, including Amazon, Spotify, Twitter, and The New York Times.
As more businesses rely on the internet to store valuable and confidential information, such attacks should serve as wake-up calls for those who haven’t implemented the necessary measures for data protection. That said, businesses should build comprehensive insider threat programs that involve both the security, legal, compliance and HR teams.
Top Employee Related Cybersecurity Concerns for Businesses
Some employee-related security concerns on the rise include;
- Phony Chatbots
Cybercriminals have created malicious Chatbots that trick employees and departmental teams to click insecure links that can expose your company’s confidential information. A recent example is the “Friend” chatbot on Facebook that tricked thousands of users into installing a virus that hijacked users’ accounts and access to personal and financial data.
- Spear Phishing
Phishing attacks, where employees receive emails from hackers with nefarious purposes, are largely on the rise. Cybercriminals have found this an easier way of gaining access to user data and files without much hassle. Conducting extensive awareness training is the best way to avoid such threats.
- Mobile Malware
Mobile devices are currently among the top targets for hackers, especially with the increasing adoption of BYOD models. Hackers take advantage of poor vulnerability management from manufacturers of these devices to exploit most employees.
To avoid such vulnerabilities, employers should formulate strict security measures, such as the use of multi-factor authentication and remote wiping to protect their business from hackers. Employers should also restrict access to company data.
How Legal Professionals Can Help Establish Great Threat Protection Practices
Ensuring a perfect balance between user privacy and security is important when establishing your insider threat program. The latter basically involves protecting your employees from invasive intrusions breaching their privacy, while the former involves protecting your business assets, including information, facilities, brand reputation, and intellectual property.
To ensure that security and privacy are perfectly balanced, cybersecurity teams should consult employment lawyers on security topics relevant to employment laws and corresponding user privacy rights. For instance, in most U.S states, employers should abide by “at-will” employment laws that give employers the power to monitor their employees actively.
In such states, employers should obtain their employees’ consent, even though it is the best practice. In alternative situations, working with a legal team can help navigate the required documentation when obtaining such consent and other issues concerning employee privacy. Employers are also encouraged to leverage the use of insider threat management tools that anonymize user data.
That aside, employers should implement thorough security policies and focus on employee training programs. Doing this sets the foundation for good company culture, demonstrates transparency, and promotes proper understanding of the measures required to keep the company secure.
Documenting these policies and proof of training sessions is beneficial as they can be provided as evidence in case of discrimination and unlawful termination lawsuits. Security and legal teams with extensive knowledge of corporate policies should work together to ensure proper documentation is done.
Working with Employment Lawyers to Recover from an Insider Threat Incident
Businesses should also have a lawyer who provides a thorough review of the local, national, and international laws when developing security and privacy policies right from the start. If a cybersecurity threat occurs, a multi-disciplinary team should respond immediately. According to local regulations, legal professionals should help security teams navigate the timelines surrounding breach disclosure to relevant parties.
For instance, according to GDPR policies, businesses should notify authorities of a data breach within 72 hours of its occurrence. Apart from notifying the authorities, both security and legal teams should also comply with local timelines and regulations guiding customer disclosure. That aside, any other information about data breaches, such as social media posts, customer emails, press releases, and blogs, should be reviewed by legal teams.
Evidence gathered during insider threat investigation by security teams can be used by legal teams when building or defending legal suits against your company. The security, legal, and HR teams should thoroughly review the evidence to find appropriate solutions and punitive measures for responsible employees.
Through this, the team can determine incidents that warrant disciplinary actions, termination, or the need for more cybersecurity training if the actions were unintentional.
Bottom Line
Security and legal teams should work together to develop an effective insider threat program. While hiring cybersecurity professionals and providing updated cybersecurity awareness training to your employees can help mitigate these threats, organizations should not ignore the importance of working with legal teams.
