Latest Trend: Hackers Bribing Employees to Install Ransomware

The call is coming from inside the house. Your employees probably aren’t actually hacking your systems, but they could still be the vector for a new cybersecurity threat. Cybersecurity insider threats occur when bad actors approach organizational insiders (such as employees) to install ransomware for them. In return, employees are offered a fixed payment or a percentage of the ransomware attack ransom.

To achieve their goals, bad actors will often identify, approach, and befriend employees to either install ransomware or provide access to privileged information. In one instance, an employee of a healthcare organization was paid $5,000 to provide access to his work tablet. This gave the bad actor access to key usernames and passwords.

While security and defense measures have advanced over the years, the increasing frequency of cybersecurity insider threats shows us that cyberattacks are growing more sophisticated. Bad actors are finding ways to bypass perimeter security measures through social engineering and other tactics. To combat these emerging threats, organizations must take steps to improve detection and prevent attacks before they occur.

So, how can you avoid insider threats? Let’s explore a few ways to fortify your system and mitigate the risk of this type of attack.

Combine monitoring tools with a 24-hour security operating center.

Investing in security now could save your organization massive amounts of time, stress, and revenue in the long term. To avoid these repercussions, organizations should implement monitoring and alert tools in combination with a security operations center (SOC) that operates 24 hours a day, seven days a week, with a focus on suspicious activity in your system. If you aren’t ready to implement a full SOC, you should at least consider adding 24-hour IT support to your security program.

Monitor your system for existing threats.

You likely already monitor internet-facing ports for suspicious activity. However, with the growing prevalence of cybersecurity insider threats, it’s a good practice to keep an eye on your internal system for existing threats, as well. Managed detection and response (MDR) and endpoint detection and response (EDR) services can help you mitigate risk by identifying threats within your systems and devices, enabling you to eliminate vulnerabilities and reinforce your security.

Implement stringent access and authorization policies and procedures.

Who has access to your systems? Employee access to sensitive data should be limited. A “zero trust” approach grants the lowest level of privilege possible to each employee and prevents unsupervised exfiltration of data at any level. Traditional perimeter security is simply not enough when ransomware attacks originate within your organization. A zero trust environment can hinder employees’ ability to deploy ransomware or share proprietary information with outsiders.

Incorporate data loss prevention and file monitoring tools.

Data loss prevention tools can be used to stop the intentional or unintentional exfiltration of protected data. Such tools help to automate and streamline areas like user access to data, permissions involving what employees can and can’t do with data, and alerting you to suspicious activity around data. For example, an employee copying or deleting large volumes of data could alert you to a potential cybersecurity issue. Monitoring file changes can also alert you to potential insider threats.

Implement dark web monitoring and alerting tools.

Another strategy to get ahead of the problem is dark web monitoring. With the right tools, organizations can scan the dark web for specific data and set alerts for suspicious activity and chatter. For example, you might set alerts for chatter about things like:

• Threats within your industry
• Threats related to your organization
• Potential cybersecurity insider threats

With an early alert that your organization has been targeted, you can take strategic steps to prevent a breach, even if a bad actor successfully contacts and befriends one of your employees.

Address organizational culture challenges.

Finally, on a less technical level, cybersecurity insider threats are often associated with disgruntled employees. People who feel fulfilled and appreciated in their workplace are much less likely to seek out or accept an offer from a bad actor. By focusing on a positive work environment where employees feel safe to voice their concerns and needs, you can significantly reduce your chances of an insider deploying ransomware in your systems – simply because they won’t be motivated to do so.

Next steps: Prepare your organization against evolving cybersecurity threats

According to ITPro, 33% of data breach incidents in 2021 were likely caused by insiders. You can significantly mitigate the risk of an internal cybersecurity threat by monitoring internet-facing ports, performing frequent audits of your internal systems for existing threats, and taking steps to ensure that your employees are unable and unwilling to deploy ransomware.

If you do one thing to protect yourself today, implement the principle of least privilege and deactivate external peripheral device access on your company computers. Doing this will help ensure that your employees only have access to the data and systems that they need to perform their jobs, and make it more difficult to exfiltrate information from your physical systems.

Need help implementing measures to protect your organization from a cybersecurity insider threat? To learn more about our managed services, how we mitigate risks and improve security, or if you simply need help determining the optimal cybersecurity solution for your organization, fill out the form below.