Intentional Insider: Is the Threat from Leakers Still Valid?

Data leaks are nothing new and the UK’s Information Commissioner’s Office (ICO) began issuing financial penalties in earnest for such incidents in 2010. At the time, one of the major headlines surrounding data leaks related to the release of diplomatic cables by Wikileaks.

Whilst the first ICO fines were issued in November 2010, Wikileaks’ Julian Assange was negotiating with press outlets and newspapers to publish details of the cables in a redacted form, therefore removing the names of sources and others in vulnerable positions. This saw the release of previously private communications related not just to politicians, but to companies too.

This was even more apparent with the Panama Papers from 2016 and the Paradise Papers from 2017, which were taken by those seeking to liberate information. 

Data leaks of this scale have not made the headlines in the same way for some years, but the threat could still be valid.

Lisa Forte, partner at Red Goat Cyber Security, admitted that insider threat attacks of this scale are rare, but “in the last three years we have seen a huge increase in insider threat attacks around the world. In particular, they are seen more in organizations that operate in new economy markets or in industries that generate a lot of R&D or IP,” she said.

Some CISOs, speaking on background, have mentioned that they are more focused on insider threat and data loss than systems being down.

Peter Gooch, a partner within Deloitte's Cyber Risk Services, said insider threat is a concern “on different levels, as we think of nation-state sponsored attackers, organized crime and even script kiddies, and they all have different levels of determination.”

Gooch explained that the definition of an insider threat is “different for different organizations and there will be a real fear of activists and disgruntled employees who will showcase what is happening in organizations.”

No one wants their internal actions to be revealed, Gooch admitted, and whilst he acknowledged he cannot imagine any company harboring anything that is illegal, no company wants their activities to be disclosed, whether legal or illegal.

“Think of the socio-economic climate, and the perception and damage a leak can cause,” he said.

The coverage these incidents increased the conversation on the insider threat. Forte noted that perpetrators are stealing with intent but not necessarily with malice.

“The correct term is ‘intentional insider’,” she explained.

This type of intentional insider is difficult to detect and to determine who they are and what sort of actions they could take. Gooch noted that in challenging business and economic environments, there may be an increase in the number of disgruntled employees, and they could be a weak link.

“There are disaffected employees who either deliberately want to cause grief to an organization or steal data to sell it or take it to another job,” he explained.

The impact of WikiLeaks and the Panama Papers was felt for a prolonged period due to the slow release of the documents, and the media response to the continual feed of new details.

Asked if she felt businesses consider these high-profile incidents in their risk profile, Forte said she is finding a lot of clients in the US do, but companies within the UK and Europe “are behind on this but slowly realizing.”

Enjoyed this article? Make sure to share it!

Looking for something else?