In The Era Of Remote Work, The Most Dangerous Insider Threat Is You

Innovation In The Era Of Remote Work, The Most Dangerous Insider Threat Is You David Endler Forbes Councils Member Forbes Technology Council COUNCIL POST Expertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based) Oct 10, 2022, 10:00am EDT | Share to Facebook Share to Twitter Share to Linkedin Chief Product Officer and cofounder of SpyCloud , helping companies around the world discover and prevent account takeover (ATO) attacks.

getty Within today’s cyber threat landscape, mitigating the risk of insider threats is a core priority for IT and cyber leaders. While insider threats are often understood as disgruntled or malicious employees acting purposefully against an organization, most insider exposure stems from risky behaviors that users with access to corporate networks engage in without being aware of the danger. This risk is intensified in the remote work environment.

Amid an unprecedented labor shortage— 11. 4 million job openings across the United States as of April 2022—and a persistent preference among employees for remote work, organizations are casting wider nets, recruiting out of state, country and time zone to compete for new talent. In the era of widespread hybrid and remote work, these seemingly inconsequential details could become key indicators of the insider threat an employee poses, often entirely by accident.

Organizations must operate with a clear understanding of these risks and implement controls to increase visibility into their exposure and remediate risks those with access to corporate networks pose. Today’s insider threats are careless, not malicious. Even before the pandemic, employees could access personal accounts on work devices using the same password as the one associated with their corporate email.

They could download an Austin FC flag for their desktop background and unwittingly deliver a malware infection to the device, or they could use an unmanaged personal or family-use device to access third-party applications that aren’t as locked down as the ones hosted by the company directly. MORE FOR YOU Juan Soto Contract Rejection Could Make Orioles A Better Buy Than Nationals Google Pixel 7 Pro Camera Samples Reveal iPhone-Beating Results The Biggest Threat To America’s Global Dominance In Software & Services Isn’t China—It’s Washington. Unfortunately, elementary cyber mistakes like these can grant a cybercriminal an all-access pass to corporate networks and leave security teams struggling to have full visibility of an increasingly unmanageable attack surface.

When third-party sites are subject to data breaches, reused logins give criminals easy paths to leverage employees’ digital identities to access corporate and other sensitive data. The average person owns between 70 and 100 online accounts , a number that increases by 25% every year. Without strong cyber hygiene, each online account associated with a digital identity creates opportunities for credentials to be compromised.

Malware can be even more dangerous. Malware infections are often virtually undetectable, and siphoned data can allow criminals to bypass protections like multifactor authentication and render even the most complex passwords useless. And malware infections are more common than organizations might think: SpyCloud’s 2022 Fortune 1000 Identity Exposure Report found 69,174 malware-infected devices across Fortune 1000 company employees and C-level leaders, many of them personal home systems.

That’s an average of 69 infections per company. A single malware infection can leave companies open to destructive ransomware or extortion attacks, as multiple account credentials can be stolen from the device along with other personal information, browser fingerprints, device and web session cookies and more. Each piece of siphoned data may offer a way into the enterprise’s network.

Infections on personal devices used for professional purposes or with work applications are a major blindspot for corporate security teams. Update cyber awareness for the era of remote work. As an employee’s digital identity becomes the only identity many companies encounter, security teams must reevaluate assumptions that applied primarily to securing in-office devices and on-premises networks.

Despite the growing popularity of solutions geared toward responding to cyber threats like ransomware, prevention is the most effective way to limit the impact of an attack, starting with reducing risk at the point of legitimate access. Employees need a clear view of the dangers they face. In the work-from-home environment, they will almost certainly blend personal and professional device use or access email or corporate communication platforms on personal devices like phones and tablets.

Organizations’ cyber hygiene requirements and training programs should reflect that reality. Using complex passwords and password managers for every account—even personal ones—could decrease exposure at both the user and the enterprise level. Last year alone, SpyCloud researchers discovered a 64% password reuse rate for users with more than one password exposed in the last year.

Further, where basic cybersecurity training previously tended to focus on phishing campaigns conducted via email, remote employees must be vigilant across all online activities on all devices they use. Downloading unverified free software might have seemed fine on a personal computer, but if users know they could be putting their entire company at risk, they might take a second look and prevent a malware infection. Similarly, they must be aware that criminals can exploit all forms of PII and attack using a range of avenues.

For example, a text message claiming to be from an organization’s leader asking for help with a money transfer or a security code generated by MFA can potentially be a criminal that has gained access to employees’ phone numbers. Ultimately, however, safer insider behavior can only go so far. At the enterprise level, organizations should deploy solutions that help them monitor each employee’s exposure and implement controls that prevent criminals from accessing sensitive data using ATO or malware attacks.

As cybercriminals become increasingly sophisticated, innovations such as analyzing recaptured breach and botnet data to pinpoint and remediate exposure can increase organizations’ vigilance exponentially, putting less pressure on employees to protect themselves. Good cyber hygiene is good for business. Remote and hybrid workers have proven to be more productive and engaged and have greater flexibility, a major factor in employee retention and a particularly important consideration for those with primary family care responsibilities.

Hiring-from-anywhere helps organizations to recruit and retain high-performing talent and pull from a more diverse talent pool. Not only does a robust preventative strategy help reduce the impact of insider threats and protect against costly and damaging cyberattacks, but it also gives organizations greater confidence to hire and retain talent remotely despite so many unknowns—a practice that has become essential to compete in today’s hiring landscape. Supporting remote workers in mitigating threats stemming from behaviors they may not even know are risky empowers companies to reap the benefits of remote employees without taking on outsized risk.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify? Follow me on LinkedIn . Check out my website .

David Endler Editorial Standards Print Reprints & Permissions.