An insider threat is a security risk that originates from within the targeted organization. Anyone with access to sensitive information can become a threat to the organization, intentionally or unintentionally. Insider threat comes in many forms - it could be a current well-meaning employee who is negligent or unaware, or a disgruntled current or former employee with more malicious intent.

1. Implement a Security Awareness Program

Provided with the necessary resources, an uninformed employee at high risk of becoming an insider threat could become a company’s best asset. Create a sense of responsibility and heighten awareness of suspicious activity. Enforce the importance of protocol, and encourage open dialogue, so employees feel comfortable reporting incidents immediately.

2. Train, Test, & Retrain

Train employees to recognize when an outsider or insider is seeking sensitive information. Post critical information in common areas, highlighting ways to spot social engineering scams, phishing emails, and insider threat. Take proactive steps to educate employees, then test their knowledge by sending a simulated phishing email to see how many employees take the bait, retrain if necessary.

3. The Principle of Least Privileges

The Principle of Least Privileges describes a security value that states that users’ permissions should remain limited to the essentials. Perform frequent audits of your workforce’s permissions and privileges to determine when permissions should be added, modified, or removed. Unnecessary access to sensitive information could cause unintentional consequences. Only those who follow strict policy and procedure when handling highly confidential data should have this access.

Have I Been Hacked?
No matter how secure you are, sooner or later you may have an accident and become hacked. Below are clues you might have been hacked and if so, what to do.

Your Online Accounts

• Family or friends say they are receiving unusual messages or invites from you that you know you did not send.
• Your password to an account no longer works, even though you know the password is correct.
• You receive notifications from websites that someone has logged into your account when you know you did not log in yourself. Do not click on any links in such notifications to check your account; instead, type the website address yourself into your browser, use your previously saved bookmark, or access your account from a mobile app.

Your Computer or Mobile Device

• Your antivirus program generates an alert that your system is infected. Make sure it is your antivirus software generating the alert and not a random pop-up window from a website trying to fool you into calling a number or installing something else. Not sure? Open and check your antivirus program to confirm if your computer is truly infected.
• You get a pop-up window saying your computer has been encrypted and you have to pay a ransom to get your files back.
• Applications seem to be crashing randomly or are loading very slowly.
• While browsing the web, you are often redirected to pages you did not want to visit or new, unwanted pages appear.

Financial

• There are suspicious or unknown charges to your credit card or bank account that you know you did not make.

Now What? - How to Take Back Control

If you suspect you have been hacked, stay calm; you will get through this. If the hack is work-related, do not try to fix the problem yourself; report it immediately. If it is a personal system or account that has been hacked, here are some steps you can take:

• Recovering Your Online Accounts: If you still have access to your account, log in from a trusted computer that you are confident is not infected and reset your password. Once you log in, make sure to set a new, unique and strong password, the longer the better. Remember, each of your accounts should have a different password. If you can’t keep track of all of them, we recommend using a password manager. Also, if it is an option, enable Multi-Factor Authentication (MFA) for your accounts, helping ensure the cyber attackers cannot get back in. If you no longer have access to your account, contact the website and inform them your account has been taken over.
• Recovering Your Personal Computer or Device: If your antivirus program is unable to fix an infected computer or you want to be more certain your system is safe, consider reinstalling the operating system and rebuilding the computer. This often requires erasing or replacing the disk drive and then reinstalling and updating the operating system. Do not reinstall the operating system from backups. Backups should only be used for recovering your personal files. If you feel uncomfortable rebuilding, consider using a professional service to help you. Or if your computer or device is old, it may be time to purchase a new one.
• Recovering Your Financial Accounts: For issues with your credit card or any financial accounts, call your bank or credit card company right away. Call them using a trusted phone number, such as the phone number listed on the back of your bank card, the number printed on your financial statements, or visit their website. Monitor your statements and credit reports frequently. In addition, consider putting a credit freeze on your credit files.

If you have suffered financial harm or feel in any way threatened, report the incident to local law enforcement.

Maxim Deweerdt (Twitter @alfasec) is a Certified Instructor at the SANS Institute, mainly teaching Cyber Defense courses. He is also a principal consultant at NVISO, where he focuses on Threat Hunting, Incident Response and SOC maturity projects. | Original Article