The leaking of company information is the violation which gets picked up by risk management specialists most often, making up nearly one-third of all incidents. In fact, this was detected by 100% of companies monitored by SearchInform, a risk management product developer.
Documents are often uploaded to flash drives (65% of all data leaks), to the cloud (24%), sent via e-mail (6%) and sent via messengers (5%).
In terms of what is leaked, SearchInform says data leakages compromise information about clients and deals (databases, personal data of VIP clients) as well as technical documentation in 23% of cases. Some 14% of data breaches comprise leaked accounting data, 9% financial data, and 9% tender documents and agreements.
The other two major types of incidents have to do with spreading negative opinion about the company and colleagues, and dismissals, making up 15% and 20% of all incidents, respectively. These incidents are a security risk as they are often accompanied by data- loss risks that may put information in the hands of competitors and damage the company's reputation.
Six percent of incidents are identified as asocial behaviour by employees, such as gambling, blackmail and drug addiction. Drugs made up the vast majority (65%) of identified incidents, with analysts finding correspondence in which buying and taking drugs were discussed, as well as traces that certain Web sites on the dark Web were visited.
Other identified incidents comprise fraudulent scheming among employees, including lobbying for the interests of affiliated counterparties, conspiracies with contractors, side schemes and side jobs. These accounted for 10% of all detected violations. In particular, one of the organisations discovered an illegal project within its perimeter which showed three current and five former employees involved. These are the most dangerous incidents for financial wellbeing, says SearchInform.
Irrational usage of work hours and sources constitute 2% of all incidents. However, their detection allowed companies to optimise teamwork. In one of the companies, 300 out of 360 people were identified as “suspicious”, enabling managers to get rid of positions that were not overloaded and allocate work among other staff members.
Alexey Parfentiev, a leading analyst at SearchInform, says: “We have analysed companies’ data from various industries: finance, logistics, retail, IT, manufacture, agriculture and services. The most unappealing fact is that 100% of organisations detected serious information security violations.”
According to Parfentiev, SearchInform’s specialists detected not only insiders or those who received kickbacks, they also identified employees in groups of high violation risk, such as those working for other companies during work hours or desperate gamblers who would indulge in their obsession every day.
“Companies have data leakage prevention measures in place, and still find corporate fraud or managerial error, proving that information security needs to go beyond leakage prevention alone to cover a much wider range of incidents,” says Parfentiev.
Share