Think Hackers Are IT's Biggest Threat? Guess Again

Iris Scans: Security Technology In Action

Hacker groups such as LulzSec and Anonymous likely come to mind when discussing data breaches in the public sector. Both groups, along with other rogue hackers, have proven themselves more than capable of bypassing government security measures and gaining access to confidential data. But, surprisingly, they are not IT's biggest threat.

According to research by the Ponemon Institute, the actions of agency employees can be even riskier. More than one third of all data breaches are internal and unintentionally caused by employees, and federal agencies are not exempt. In fact, the public sector is one of the most targeted industries, second only to financial services.

"While external attackers and their evolving methods pose a great threat to companies, the dangers associated with the insider threat can be equally destructive and insidious," said Larry Ponemon, chairman of the research firm, in a recent interview. "Eight years of research on data breach costs has shown employee behavior to be one of the most pressing issues facing organizations today, up 22% since the first survey."

According to Privacy Rights Clearinghouse, government agencies have seen a steady increase in employee-caused data breaches over the last four years. Employee negligence has caused over 150 breaches since January 2009, resulting in the loss of more than 92.5 million data records.

[ Find out why malicious insider threats are getting harder to stop. Read Insider Threats Get More Difficult To Detect. ]

Unfortunately, public CIOs can't simply "plug the leak," but they can place a greater emphasis on the underlying cause of many data breaches: using insecure, un-managed methods to transfer sensitive data, such as:

-- Easily lost or stolen removable storage, particularly those housing unencrypted data (USBs, hard drives, disks, etc.)

-- Emails containing sensitive data sent to the wrong party

-- Third-party file-sharing and storage websites (Dropbox, Google Drive, etc.)

As occurrences increase in size and frequency, the cost per record lost is also rising. The Ponemon study reveals that the U.S. has one of the highest average costs per record ($136). The study also shows that third-party errors and lost or stolen devices have the most effect on the cost of a data breach. Making matters more difficult is that many federal organizations can now be held liable for breaches occurring with partners. Healthcare, for instance, is currently adapting to the new HIPAA amendment that can hold business associates responsible for data breaches. The new regulations can cost violators up to $1.5 million per record.

Anticipating an employee-caused data breach can be incredibly difficult. However, there are several areas in which agencies can improve:

Assess the risk. Discovering and prioritizing possible vulnerabilities in the storage and transferring of sensitive data is a critical first step. To start, ask four questions about your agency:

-- How do your employees typically send and receive confidential files?

-- What's your agency's common practice for accessing mobile information?

-- If the agency has experienced previous incidents, what were the causes?

-- Do you have well-documented policies in place that teach staff which file transfer methods are okay, and which are risky?

Regularly review regulatory compliance requirements. The Federal Information Security Management Act (FISMA) requires agency officials to audit data security initiatives and report results annually. However, at the rate that technology evolves, IT should regularly determine the status of agency compliance, particularly if employees' routine actions meet regulatory requirements.

Secure and manage data in motion. Data that is being transferred from one source to another has a particularly high risk of being lost, stolen, or otherwise compromised -- especially in the case of internal breaches and the potential for human error. IT must implement systems that can effectively secure and manage data in motion. Transparency is also important. You need visibility into what was sent, how it was sent, to whom it was sent, and who accessed it.

Educate agency employees. Inside jobs with malicious intent do occur, but in reality many incidents are the result of accidents. Mitigate the risk at the source by educating agency employees on compliance issues and poor data-handling practices, such as third-party storage, insecure email and unapproved devices.

Tightening the security perimeter will always be a top priority for federal IT professionals. But as agencies invest to keep the bad guys out, it's equally important to consider the people who are already in.