How to Identify High-Risk Employees for Cyberattacks
'We have met the enemy and he is us.'
So said Pogo, or whoever thought of if first. The point is, your own people present the biggest threat of a cyberattack.
That's because they share the malware, leave the back door open, and otherwise invite the enemy in for dinner. Here's who they are and how they do it.
Lawyers, Staff, and Legal Services
Because lawyers communicate online more than ever, they are continually at risk of a cyberattack. DLA Piper, a BigLaw global firm, is a recent example.
The firm prides itself on cybersecurity, but like airplane disasters, most of the time it's due to operator error. DLA Piper had to shut down its digital operations around the world while it tried to figure out what happened.
Attorneys are targets for ransomware because they deal in information and they have money. If they use insecure email, websites or networks, they are practically inviting hackers to the party.
As general counsel, it's not enough to train your legal department. Outside counsel and service providers mess up, too.
High-Risk Users
Companies should identify high-risk users and intervene. In addition to training workers, employers need to monitor how they use technology.
Harvard Business Review recommends analytics to review users, track data and address negligent or malicious actions. For example, high-risk behavior includes:
- Accessing, moving, or deleting large volumes of sensitive content
- Inappropriately creating, storing, or sending sensitive content
- Extreme negative sentiment towards the organization in messages
Employees should be advised they have no privacy when using company computers, networks, and phones. They should also know that compromising cybersecurity is a serious offense.
Related Resources:
- The Biggest Cybersecurity Threats Are Inside Your Company (Harvard Business Review)
- Lawyer Mistakenly Sent SEC Memo to Reporter (FindLaw's In House)
- Why Vacation Emails and 'Workcations' Harm Company Culture (FindLaw's In House)