# Why insider threat presents a big risk to financial services organisations
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2020-11-25
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Insider Threats in Financial Services: Protecting Against
Meta Description: Learn how financial services firms face cyber threats from insider risks and misdirected emails. Discover the importance of protecting sensitive data.
URL: https://financedigest.com/why-insider-threat-presents-a-big-risk-to-financial-services-organisationshtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/untitled-design-2020-11-25t191553-1736838698443-compressed.jpg)

_By **Adam Strange,** HelpSystems_

In today’s highly regulated environment, financial services organisations are trusted with far more than just money; they are also responsible for keeping customers’ highly sensitive personal and financial data secure. And privacy legislation, such as GDPR and CCPA, has come into force to ensure that they are doing this diligently. Likewise, with the all the publicity we’ve seen around [data breaches](https://www.financedigest.com/amazons-twitch-blames-configuration-error-for-data-breach.html "Amazon’s Twitch blames configuration error for data breach"), as individuals, we are far more aware of the growing value of our data and the need to protect it. So, unfortunately, are cybercriminals, which means financial organisations are prime targets for malicious cyberattack. However, this isn’t the only [threat they face](https://www.financedigest.com/cup-holder-market-emerging-industries-challenges-and-threats-faced-by-key-vendors-and-global-business-outlook-till-2031.html "Cup Holder Market Emerging industries, Challenges and Threats Faced by Key Vendors and Global Business Outlook till 2031"). In fact, not a [day passes without these](https://www.financedigest.com/new-zealand-marks-queen-elizabeths-passing-on-national-day-of-mourning.html "New Zealand marks Queen Elizabeth’s passing on national day of mourning") firms’ own employees putting data at risk.

**Insider threat cited as having the potential to cause a lot of damage**

When it comes to reducing overall breach risk, it is easy to assume that employees represent low-hanging fruit – based on the premise that it is easier to control the actions of a company’s own employees than it is to defend against external attackers. However, here at HelpSystems we have recently undertaken some [research](https://www.helpsystems.com/about/news/almost-two-thirds-financial-services-firms-have-suffered-cyber-attack-last-12-months), interviewing 250 CISOs and CIOs in financial institutions about the cybersecurity challenges they face. And the reality is that insider threat – whether intentional or accidental – was cited by more than a third (35%) of survey respondents as one of the threats with the potential to cause the most damage in the [next 12 months](https://www.financedigest.com/prince-harry-and-meghan-to-visit-britain-next-month.html "Prince Harry and Meghan to visit Britain next month"). Likewise, phishing emails were cited by 20% of survey respondents. Add these two together and you can start to get a picture of the challenge these internal employee-centric risks present for [financial services firms](https://www.financedigest.com/financial-services-firms-turn-to-big-data-intelligence-to-fight-fraudulent-activity-according-to-xerox-study.html "FINANCIAL SERVICES FIRMS TURN TO BIG DATA INTELLIGENCE TO FIGHT FRAUDULENT ACTIVITY ACCORDING TO XEROX STUDY") – perhaps a far bigger one than the external threat. While external attackers are always motivated by malicious intent, the employee population is far more mixed, and motivations are a grey area where the reasons behind breaches, whether through simple human error or deliberate actions, are harder to determine. This makes understanding, and mitigating, insider risk a far more problematic exercise.

**Misdirected emails are also a big risk**

At the same time, the latest Information Commissioner Office (ICO) report has just been published and the [data confirms that misdirected email remains one of the UK’s most prominent causes of security](https://www.financedigest.com/normalizing-advanced-cloud-data-security-with-normalyze-from-amer-deeba-and-ravi-ithal.html "Normalizing Advanced Cloud Data Security with Normalyze from Amer Deeba and Ravi Ithal") incidents. This report further demonstrates the need for all [organisations to control the dissemination of their classified data](https://www.financedigest.com/avoiding-a-big-data-car-crash-how-to-organise-your-data-to-detect-fraudulent-claims.html "Avoiding a big data car crash: How to organise your data to detect fraudulent claims") as it states that misdirected email is, alarmingly, a 44% bigger risk to organisations than phishing attacks.

This is yet another area where organisations must ensure their [data](https://www.financedigest.com/modern-data-protection-how-organisations-can-protect-against-cyber-attacks.html "Modern Data Protection: How organisations can protect against cyber attacks") protection policies are robust enough to not only protect themselves but also their employees from the seemingly simplest of mistakes. Again our research showed that increased [remote working](https://www.financedigest.com/digital-insurance-and-the-remote-working-and-studying-boom.html "Digital insurance and the remote working and studying boom") practices was a cause for concern, with 36% stating that they saw it as a cybersecurity threat with the potential to cause significant damage. Therefore, what remains paramount is that organisations provide their employees with the technology tools necessary to prevent the simple [human errors that have the potential to result in data](https://www.financedigest.com/outthink-raises-10-million-to-tackle-human-errors-behind-data-breaches.html "OutThink raises million to tackle human errors behind data breaches") loss, and as a consequence, severe financial and reputational damage.

**[Understanding what protection your data](https://www.financedigest.com/understanding-the-realities-of-payment-data-monetisation.html "Understanding the realities of payment data monetisation") requires**

Clearly, it is crucial that financial services organisations shift the dial on insider [risk](https://www.financedigest.com/is-2022-the-year-green-finance-incorporates-climate-risk.html "Is 2022 the year green finance incorporates climate risk?") and reduce breach frequency, because the penalties for failing to do so are becoming increasingly draconian, and the repercussions from customers much more severe. But put simply, before you can defend, you need to [know](https://www.financedigest.com/how-much-do-you-need-to-know-about-the-atos-cryptocurrency-letter.html "How much do you need to know about the ATO’s Cryptocurrency Letter?") what protection your data requires and you need to know what you’ve got, where it’s stored, why you have it and who has access to it. Once you’ve got to grips with that, you can identify what is of true value to the organisation – what’s business-critical and what’s sensitive – and then how best to treat it. In order to do that you need to think about what the impact would be if a piece of information was leaked or lost. If it was made public, would it harm the business, your customers, partners or suppliers? Would it put an individual’s security or privacy at risk? Would you lose advantage if a competitor got hold of it? Is it subject to any [privacy or data](https://www.financedigest.com/how-to-navigate-multiple-data-privacy-regulatory-frameworks.html "How to navigate multiple data privacy regulatory frameworks") laws, or regulatory compliance?

While this all sounds relatively straightforward, data visibility was another problematic area and subsequent threat emphasized in our research. Data visibility and knowing what data is where and who has access to it was highlighted as having the potential to cause the most damage by 14% of our survey respondents. Combine this with internal cybersecurity fatigue, which more than a quarter (28%) cited as potentially damaging, and you can start to appreciate the importance of providing tools and awareness training to help prevent those easily [avoided mistakes](https://www.financedigest.com/mistakes-to-avoid-while-choosing-a-private-money-lender.html "Mistakes To Avoid While Choosing a Private Money Lender") from happening in the first place.

**Employees need tools, training, education and the right culture**

As I mentioned, it is a complex problem without a simple answer and this is where employee education is key.  Employees play a vital role in ensuring the organisation maintains a [strong data](https://www.financedigest.com/global-shares-slide-dollar-gains-as-rates-rise-on-strong-data.html "Global shares slide, dollar gains as rates rise on strong data") privacy posture. For this to be effective, organisations need to ensure that they provide regular [security awareness training to protect](https://www.financedigest.com/the-digital-finance-revolution-empowered-consumers-turn-digital-to-protect-financial-security.html "The digital finance revolution: empowered consumers turn digital to protect financial security") sensitive information. In terms of how they go about doing this, they must invest in user training and education programmes. Users are your most important security resource, so train them to be an asset rather than a liability. Users should be a critical part of an organisation’s security posture, not excluded due to the associated risks.

Likewise, the security culture of the [firm must](https://www.financedigest.com/oil-firms-must-step-up-exploration-off-norway-to-unlock-potential-npd.html "Oil firms must step up exploration off Norway to unlock potential -NPD") be inclusive towards employees, making sure they are continually trained so that their approach to security becomes part of their everyday working practice and security is embedded into all their actions and the ethos of the business.

**How data classification can help**

One way to do this is through the implementation of data classification tools, which not only help organisations to protect their data by putting the appropriate security labels on it, but also help [educate users to understand how to treat different types of data with different levels](https://www.financedigest.com/poverty-education-levels-draw-battle-lines-in-french-election.html "Poverty, education levels draw battle lines in French election") of classification and sensitivity. Here at HelpSystems our data classification solution enables users to classify both their emails and documents according to their sensitivity, using both visual and metadata labels. Once labelled, data can be controlled to ensure that emails, documents and files are only sent to those you want to receive them, [protecting your sensitive information](https://www.financedigest.com/protecting-your-financial-information-and-identity.html "Protecting your Financial Information and Identity") from accidental loss.

It is [technology like this that leaders within financial services](https://www.financedigest.com/how-advanced-self-service-technologies-are-changing-the-face-of-finance.html "How Advanced Self-Service Technologies are Changing the Face of Finance") organisations should have in place to protect their employees, prevent misdirected emails, the inadvertent sharing of documents and files and ensure that the organisation is complying with data protection legislation. Remote working is likely to remain, regardless of any [future regional](https://www.financedigest.com/renal-cyst-treatment-market-covid-19-industry-analysis-future-trends-opportunity-growth-regional-outlook-and-forecast-2028.html "Renal Cyst Treatment Market COVID-19 Industry Analysis, Future Trends, Opportunity Growth, Regional Outlook and Forecast 2028") or national lockdowns, therefore, making sure that employees have the tools to prevent mistakes and the accidental sharing of data is going to be more important now than it has ever been. The place to start is making sure that any data is appropriately labelled, so that the employee knows how it should be handled.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---