Stop and think for a moment: What have you done that makes you an insider threat?<\/p>\n\n\n\n
The digital environment we live and work in is rapidly expanding and dramatically increasing the amount of information users can access.\u00a0 That’s why in today\u2019s organization, insiders pose a vast array of threats that must be continuously evaluated and properly addressed.\u00a0That being said, <\/span>Not all insider threats are technologically oriented or require hacking or software knowledge and skills, and even more concerning is the rise of non-malicious insiders that pose a threat to our digital assets.\u00a0<\/p>\n\n\n\n STAT: In one recent survey, nearly 90 percent of organizations asked believe they are vulnerable to insider threats.\u00a0Approximately 34 percent felt they were extremely or very vulnerable.<\/p>\n\n\n\n One recent survey found that over half of those asked said they were planning on increasing funding to the threat from insiders.\u00a0While that is an encouraging figure, where they spend the money will be the telling factor.\u00a0Many organizations have already invested in identity management and access control; however, that does not mean those issues are properly addressed.<\/p>\n\n\n\n Access control and identity management are essential components in an organization\u2019s insider threat risk management program.\u00a0That being said, <\/span>There is a common void that has been identified that is often overlooked in many organizations.\u00a0The point of vulnerability is the multifunction (copier, printer, fax machine and scanner) device.\u00a0<\/p>\n\n\n\n The following two incidents exemplify\u00a0reflect <\/span>one of the more common issues that involve access control and identity management.<\/p>\n\n\n\n INCIDENTS:\u00a0 <\/span>The first multifunction device <\/span>incident took place when documents that were sent to the device <\/span>and received by the device were all stored <\/span>on the internal storage of the multifunction device<\/span>. The device did not require a user to enter in their user <\/span>ID and password to access it\u00a0the device<\/span>.\u00a0Because of that shortfall, anyone with physical access to the device could access,\u00a0and <\/span>print or email any document that was sent to it\u00a0the device <\/span>and was not deleted by the user or administrator.<\/p>\n\n\n\n The second incident involving a multifunction device <\/span>was very troubling.\u00a0Many organizations lease or rent the devices, and at the end of the agreement\u00a0lease or rental <\/span>returns it to the company that owns the device and leases\/rents <\/span>it out<\/span>.\u00a0One of the devices that had been returned was sold online as a refurbished device.\u00a0It was purchased and put into operation in a training facility.\u00a0Once it was in operation, the new owner discovered 1,000 documents that were still present and stored on the device.\u00a0Based on those documents, the device was clearly located in a human resources department of a large company.\u00a0It was packed with sensitive personal identifying information\u00a0PII<\/span> and protected health information PHI<\/span>.<\/p>\n\n\n\n In both of these incidents, anyone who could physically access these devices had instant access to all the information that was sent to and stored on the device.\u00a0It should be noted that some producers of multifunction devices have integrated biometric (fingerprint) identification and access control on their equipment.\u00a0Often, that requires an integration of physical and digital controls.<\/p>\n\n\n\n Make no mistake about it<\/span>, the threat posed by insiders is present in every organization, which\u00a0That <\/span>makes addressing this threat essential.\u00a0 However, reducing the risk of insider threats is a very complex undertaking.\u00a0This multifaceted threat consists of malicious insiders, uneducated insiders, careless and negligent insiders and a spectrum of actors.<\/p>\n\n\n\n Clearly<\/span>There is no one universal answer or solution that addresses all aspects of this issue.\u00a0The only thing that seems to be universal is recognition that insiders pose the greatest risk to cyber security since they are trusted and given access to our information assets.\u00a0 Behavioral modeling coupled with biometrics (facial recognition and fingerprint identification) seems to be a combination that holds the greatest promise of addressing the challenge \u2014\u00a0but as this continues to evolve, we will see more preemptive cyber security systems.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" Stop and think for a moment: What have you done that makes you an insider threat?<\/p>\n","protected":false},"author":7,"featured_media":25506,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":130,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[16,130,24,58],"tags":[],"coauthors":[858,888],"class_list":["post-21280","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-networks","category-net-defense-blogs","category-opinion","category-the-compass"],"acf":{"subheadline":"","legacy_arc_id":"QJ3D7FGX3NGMVH2J5NFJGWTGUU","arc_canonical_url":"\/opinion\/the-compass\/net-defense-blogs\/2016\/05\/05\/how-multifunction-devices-put-you-at-risk-for-insider-threats\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n