Libby Bevin

The first computer software program was released and executed in 1948 at the University of Manchester: a math program that computed the greatest divisor of 2 to the 18th power. It took 52 minutes to calculate the answer.

Software has come a long way since then. It powers the digital economy; organizations in every industry use software to solve business challenges, drive innovation, and deliver stakeholder value.

Along the way, however, those organizations face multiple implementation challenges and risks. If those risks aren’t identified and addressed early, the implementation of new software can go awry and create serious problems.

Implementation challenges can disrupt workflows, hamper business processes, and curtail employees’ productivity and efficiency. Ultimately, they can derail the company’s IT budget and tank the ROI of technology investments.

So what are the most common software implementation challenges? And how can your organization avoid them? This guide answers that question.

5 Key Risks of Implementing New Software

In project management, planning is critical – and yet, too many companies fail to create comprehensive plans, and then the application doesn’t deliver its expected outcomes. For a successful implementation process and high ROI, a clearly defined and detailed plan is essential.

The plan must clarify the goals you expect to achieve from the software. It should help guide execution, prepare the system implementation and testing team, and include essential metrics to measure the project’s success.

Thorough planning can help you avoid these five critical risks of implementing new software systems.

1. Unrealistic Expectations

   What it means: You expect something from the software, but it doesn’t deliver.

   Before implementing software, you will have some expectations from it, such as:

   • It should streamline operations through automation.
   • It should lower costs for one or more business units.
   • It should be easy to deploy and use.
   • It should seamlessly integrate with the existing technology stack.
   • It should help the organization to meet its customer experience or customer success goals.

   While it’s perfectly OK to have any of these expectations, if expectations don’t align with what the software can actually deliver, you will struggle to meet these goals. Such misalignments can turn out to be costly mistakes.

   Strategies to Reduce the Risk of Unrealistic Expectations

   To avoid these problems, vendor communication is critical. Before the rollout, ask the software vendor pointed questions such as:

   • What are the software’s unique or new features?
   • What can it do? Equally important, what can’t it do?
   • Can it help us meet “X” goal? How?

   Define the implementation timeline and critical milestones to keep the project on track. Finally, identify the must-have deliverables that the vendor must provide to assure that stakeholder expectations will be met.

2. Adopting Off-the-Shelf Software

   What it means: A ready-to-use software without modifications may seem attractive – until it’s not.

   Many organizations use commercial off-the-shelf (COTS) software for a wide range of applications, business challenges, and use cases. COTS can be beneficial if:

   • You want to buy a ready-made, pre-tested, and trusted software.
   • You don’t need to customize it.
   • You don’t have a development team to build a bespoke solution.
   • You want to save money and avoid expensive greenfield software projects.

   End-users can use a COTS in an almost “plug and play” manner.

   All that said, COTS can also create risks that harm the organization later. For example, the vendor may stop supporting the software with little or no notice. This can be especially problematic if the COTS has security vulnerabilities that can jeopardize your software supply chain security and increase the risk of cyberattacks and data breaches.

   The vendor may also provide only generic support that’s inadequate for your specific business needs. Many COTS don’t offer a simple upgrade path from one version to another. Finally, the software may lack a feature request process and product enhancements such as plugins or add-ons to extend its functionality for your specific use cases.

   Strategies to Reduce the Risk of Commercial Off-the-Shelf Software

   Before investing in COTS, confirm that the vendor will support the product for the entire period you plan to use it. Inquire about premium support or support per your specific service level agreements (SLAs).

   If you reuse any components, your team should have the right skills and access to the source code for a successful implementation. Team members should have control over the application’s performance and functionality and be able to add plugins or add-ons per business need.

   It’s also crucial to find and fix security issues and errors before they open the door to cyber attacks. One 2021 report found that the average time to fix critical cybersecurity vulnerabilities had increased to 205 days.

   That’s 205 days a hacker has access to your systems and data because of a vulnerability in the software’s code. To protect your organization, ask the vendor about its security patching and version upgrade schedule.

3. Inadequate Resources for Implementation and Testing

   What it means: Implementing new software without a dedicated team to manage implementation and testing can affect its ability to meet your needs in a real-world environment.

   One reason for software implementation failure is that organizations depend on the vendor for end-to-end implementation and testing. While the vendor’s job is to implement the software and customize it to your specifications, only you know your business best, and you must have the right resources in place to manage its implementation, testing, and go-live.

   Strategies to Reduce the Risk of Inadequate Resources

   Identify dedicated resources to work with the vendor on implementation and pre-deployment testing within the project timeframe. Involve the relevant stakeholders and process owners throughout the implementation lifecycle to assure you get the solution you expect and need.

4. Poor Change Management

   What it means: A failure to prepare users for the change to new software can limit adoption and result in failure to achieve expected goals.

   Humans are creatures of habit, so any new change may cause resistance. When implementing new software, people will push back, delaying implementation or creating adoption challenges after implementation. Poor change management may also lead to a decline in productivity and a demotivated or burned-out workforce.

   Strategies to Reduce the Risk of Poor Change Management

   For successful software implementation that delivers on its goals, you must manage the people-side of the change. Prepare staff with proper training, onboarding, and guidance to help them adapt to the new system and modify their behavior accordingly.

   If possible, identify a few testers and “evangelists” from the end-user group to test the product and drive its adoption after deployment. This will also help the team identify administrative or business process changes that will be necessary to facilitate the success of the new software.

   Senior leadership should set and drive the communication strategy to show staff the advantages of the new software. Make sure to clarify how it can benefit their day-to-day work and improve the organization’s efficiency and quality.

5. Poor Data Migration and Tech Integration

   What it means: If the new software cannot integrate with other systems or maintain data integrity, that will affect your data architecture and business outcomes.

   Does the new ERP software or CRM platform require data to be migrated from an old system? If yes, the new system should maintain data integrity to assure you don’t lose any valuable intelligence that informs your organization’s decision-making.

   The data migration should happen seamlessly, without affecting existing processes or business continuity. Also, the two applications should operate in tandem until you have completed the migration and implementation.

   The new software should also flawlessly integrate with your existing tech stack and offer interoperability with other software. If it doesn’t, that might cause usability problems after deployment.

   Strategies to Reduce the Risk of Poor Data Migration and Tech Integration

   During implementation, your project team must continually verify data integrity as it moves between the old and new applications. They should also assure its security so that nothing falls through the cracks concerning privacy, security, and compliance.

   It’s also important to check that the software aligns with the organization’s IT architecture and is fully interoperable with other systems and applications.

Strengthen Risk Management with Reciprocity ZenRisk

A robust plan with a detailed risk management component can help you avoid these common software implementation challenges and the consequent problems such as cost overruns, project scope creep, and missing functionalities.

Visibility into the risk landscape is vital for effective risk management before, during, and after software implementation. Here’s where a platform like ZenRisk comes in.

Mitigate risk and stay ahead of threats with actionable insights in the context of your business. Conduct effective cybersecurity risk assessments with ease, monitor ongoing threats, and free your teams from time-consuming manual work.

Through one comprehensive platform, you can evaluate, manage, monitor, and mitigate risks throughout your technology stack. To see how ZenRisk can strengthen your enterprise risk management program, schedule a demo today.

Although scammers have been around for far longer than the internet, the advent of cyberspace has presented crafty criminals with a unique set of opportunities to take advantage of technology users. These attempts to trick users into giving cybercriminals what they want are called phishing attacks, and they’re on the rise.

Phishing attacks are a type of social engineering attack and come in many forms, which we’ll examine more thoroughly later in this article. Generally, a phishing attack involves a fraudster pretending to be someone they’re not and making a request for information from their target.

Most people are familiar with phishing attacks — phony emails, scam phone calls, or desperate Facebook messages asking for money have become somewhat expected and accepted these days. However, phishing attacks are getting more sophisticated, and are targeting enterprises with far more to lose than the average individual.

While a phishing attack targeting an individual to steal personal sensitive information like credit card numbers or bank account information can be devastating for the victim, a phishing attack that targets a large organization has the potential to affect hundreds — if not thousands — of people, from employees to customers.

Cybercriminals who want to gain access to your organization’s systems to execute a cyberattack know that your employees are probably the weakest link in your security defense system. And phishing attacks are a relatively easy way for them to bypass other security measures you might have in place.

Phishing attacks also have an extremely low barrier to entry. It takes little to no money to execute a phishing attack and send it to millions of users. Even if just one person falls victim to the scam, the return on the hacker’s initial investment will be huge.

Recent research confirms that phishing attacks play a dominant role in the digital threat landscape. Verizon’s 2020 Data Breach Investigations Report shows that phishing was the second largest cybersecurity threat involved in security incidents, and the largest cyber threat involved in data breaches. In fact, more than 22 percent of data breaches involved phishing in some way.

A report from Google reveals a similar trend. According to their research, phishing websites grew from 149,195 in January of 2020 to 522,495 — a 350 percent increase in just two months. This rise in phishing attacks poses a significant threat to all organizations, and the best way to avoid phishing attempts is by being able to recognize them before you become a victim of a successful attack.

From stealing sensitive information to interrupting operations, successful phishing attacks can give cybercriminals exactly what they need to do damage to your business. And although technology has evolved to meet the rapidly growing threat with a variety of tools that are designed to catch and stop phishing attacks before they reach you, threat actors are always working to find new ways to infiltrate your systems.

Time and time again, phishing has proven to be the cheapest, easiest, and most effective way to do exactly that. For these reasons, it’s likely that phishing isn’t going anywhere any time soon.

If you want to keep your sensitive information safe, it’s important that your organization and its employees know how to spot some of the most common types of phishing attacks so you can prevent them.

Common Types of Phishing Attacks

There are a number of ways that cybercriminals can execute a phishing attack. Which vector they choose, the tactics they use, and the end goal for the attack will vary, depending on the context. However, there are some general red flags you should be aware of when trying to identify a phishing attack.

For each of the different types of phishing attacks we include, we’ll also provide suggestions for identifying these attacks as well as some things you can do to prevent them.

Email Phishing Attacks

Email phishing attacks are the most common type of phishing attack. Typically, this method of attack involves a cybercriminal impersonating a legitimate identity or organization and then sending a mass email to as many email addresses as they can get hold of.

Sometimes, an email phishing attack can originate from a legitimate email account. When someone’s login credentials become compromised, it’s possible for a threat actor to use their email account to execute a phishing attack on another employee or acquaintance. Other times, an email phishing attack will look like it came from a legitimate source upon first glance, but is actually from a fraudulent account.

For example, you might receive an email that looks like it came from a company like PayPal. This email might instruct you to click on a link to rectify a discrepancy with your account. When you click on the link, it may take you to a spoofed page, or a fake website, that looks exactly like the PayPal homepage where you enter your login credentials.

Some phishing emails skip the link altogether and ask you to download an attachment straight from the email itself. This attachment could contain malware like ransomware or a virus that could infect your computer and spread to your entire system. As a rule, you should avoid downloading email attachments unless you are 100 percent certain that it came from a verified sender.

Although you might assume that the success of a successful email phishing attack hinges on how closely the attack email resembles a piece of official correspondence, some hackers intentionally create emails that seem fake to filter out any recipients who are too smart to be tricked. This method actually weeds out the targets who are less likely to fall victim to a scam, making it easier for threat actors to focus their efforts on those who are more gullible.

How to Spot Email Phishing Attacks

If your first instinct is that an email is fake or attempting a scam — you’re probably right. The first step to identifying an email phishing attack is to check the legitimacy of the email address itself.

You should also try to verify the claims within the email directly with the source. For instance, going directly to the PayPal homepage in your browser as opposed to clicking on the link in the email.

Once you’re there, you should always make sure that the site you’re visiting is secured with a digital certificate. If a site has a padlock icon next to the site name, that means that any information sent between your browser and the website is sent securely, and can’t be intercepted and read by someone else while the information is in transit.

Another easy way to tell if an email is part of a phishing scam is to examine the content. Most of the time, email phishing attacks will use threats or a sense of urgency to scare users into doing what they want. Phishing emails often contain generic salutations, grammar mistakes, and spelling errors scattered throughout.

You should always closely examine brand logos, as well. While some email filters can spot stolen logos via HTML attributes, malicious actors will often alter the HTML attribute of the logo so it goes undetected. The most popular way to do this is by slightly changing the color of the logo.

How to Prevent Email Phishing Attacks

These days, there are tools available to help individuals and organizations stop phishing emails before they even reach your inbox. Some of these tools are already built into your email platform and may be too effective. For instance, if you’ve ever found an important email in your junk folder, it was probably sent there because it looked like spam.

However, even with tools in place to stop phishing emails, it’s likely that some will still get through to you or your employees. The best way to prevent your employees from opening phishing emails is to provide security awareness training. Training your employees to spot and delete phishing emails is the most effective way to stop email phishing attacks from taking place.

---

Spear Phishing Attacks

Although this form of phishing attack also uses email, it’s different from most email phishing attacks in that it’s a targeted attack on a specific person as opposed to a large number of random recipients.

To execute a spear phishing attack, cybercriminals will typically already have information about their target, including their name, place of employment, job title, email address, and specific information about their job role. This means that the threat actor has probably carefully selected and then spied on their victim before executing the attack.

Spear phishing emails are often more personalized in order to trick the victim into thinking they’re from a reputable sender. These types of attacks are usually executed to gain access to a specific person’s login credentials because they have access to sensitive information.

For example, an employee at your company might receive an email that looks like it came from another employee. Maybe this email contains an attachment that appears to be an internal financial report that leads the user to a fake Microsoft Office 365 login page. The fake login page might even have the user’s username already pre-entered on the page, further adding to its disguise. Once the user enters their password, the hacker has successfully stolen their credentials and can use them to login to the real Microsoft Office 365 and access all of the data that user has permission to see.

These types of emails are often less obvious, and require even further scrutiny and inspection than typical email phishing attacks.

How to Spot Spear Phishing Attacks

Most of the advice we gave to spot an email phishing attack rings true for this type of attack as well. Always go directly to the website or software as opposed to downloading attachments or clicking on links. In this case, if you know the supposed sender, you might try giving them a call before you do anything drastic, especially if the request involves something to do with finances.

How to Prevent Spear Phishing Attacks

Again, we recommend following the same directions we provided to prevent email phishing attacks — employ tools that are designed to help filter out phony emails before they reach your inbox and make sure that all of your employees receive regular security awareness training so they can identify phishing attacks before they become a victim.

You should also always practice the principle of least privilege so that your employees only have access to the information they need in order to carry out their specific duties. Similarly, require employees to regularly change and use only strong passwords, and make sure they aren’t repeating passwords for multiple accounts.

---

Whaling Attacks

As the name suggests, this type of phishing attack is targeted at the “big fish” of your company — senior executives, board members, or even celebrities who might have access to more sensitive data than lower-level employees. Whaling attacks are often executed via email as well, which often use a high-pressure situation to hook their victims.

Although whaling attacks have the same end goal as any other type of phishing attack, the techniques threat actors use tend to be a lot more subtle. In these attacks, fake links and malicious URLs aren’t typically as useful, as criminals are often imitating senior staff.

One increasingly common variety of whaling attack involves bogus tax returns, as tax forms are highly valued by cybercriminals because they contain a host of useful information about their victims: names, addresses, Social Security numbers and bank account information.

How to Spot Whaling Attacks

Whaling attacks are difficult to spot because they often appear the most legitimate. When successful, whaling attacks usually yield the highest return for cybercriminals, as their victims have the most access to the most sensitive information within your company.

Again, make sure you verify the sender before taking any action that could result in a breach. Check the legitimacy of the sender’s email address closely, and try reaching out to them directly if you have any question at all about the action they’ve requested of you.

How to Prevent Whaling Attacks

Include your executives in security awareness training so they are more equipped to spot whaling attacks. Afterall, the culture of security begins at the top, and if your executives understand the importance of practicing secure email habits, then your employees will follow suit.

Fortunately, whaling attacks are far less common than the standard run-of-the-mill phishing attacks. However, your executives should be prepared to identify these types of attacks even if they never experience one.

---

Clone Phishing

A clone phishing attack takes place when a cybercriminal creates a malicious replica of a recent message you’ve already received and then re-sends it from a seemingly credible source. Most of the time, victims of clone phishing attacks will first receive a legitimate email from a company and then receive what appears to be the same message shortly after.

In the cloned email, the links or attachments from the original email will be replaced with malicious ones and are accompanied by the excuse of re-sending the message due to issues with the links or attachments in the previous email.

How to Spot Clone Phishing Attacks

If you receive two identical emails from what appears to be the same sender back to back, it’s probably a clone phishing attack. Closely examine the two emails next to each other to try to determine which one is legitimate, but avoid clicking any links or downloading any attachments from either of the emails and visit the site of the sender directly, instead.

How to Prevent Clone Phishing Attacks

The same means of identifying other types of email phishing attacks also apply here. First, check the email address of the senders to see which one is likely fake. Then, visit the website of the supposed sender directly as opposed to clicking any links in either of the emails.

As always, employee training is the best way you can prevent any type of email phishing attacks. The better your employees are at spotting fake emails, the less likely they are to fall victim to any types of phishing attack.

---

Smishing Attacks

Smishing — or SMS phishing — attacks use text messages to target their victims in lieu of email. However, these types of attacks operate much in the same way as email phishing attacks: threat actors send texts from what appears to be a legitimate source that contain malicious links.

These links might be disguised as a coupon code or an offer to win some sort of prize and take the victim to a spoofed webpage that is opened in their smartphone’s browser. Typically, these types of attacks have the same goal as email phishing attacks — to steal login credentials or financial information from users.

How to Spot Smishing Attacks

Smishing attacks will often contain many of the same errors that email phishing attacks contain. Grammatical errors, spelling mistakes, or text lingo (eg. LOL) are all common indicators that a text message is not legitimate. Similarly, a smishing attack will likely originate from a phone number that you do not recognize.

How to Prevent Smishing Attacks

Generally, if you receive a text from an unknown number, you should not open it. If you do open it, do not click on any links that have been delivered to you via text. Again, we recommend visiting the site of the supposed sender directly.

To prevent cybercriminals from getting access to your phone number in order to execute a smishing attack, do your best to keep your phone number private. Entering your phone number on other websites, even if they’re secure, can lead to cybercriminals getting hold of that information and inundating your phone with smishing attacks.

---

Vishing Attacks

This type of phishing attack also relies on the use of a phone as the vehicle of attack. Vishing, also known as voice phishing, is a phishing attack that’s done with a phone call. Typically, this type of phishing attack relays an automated voice message from what is meant to seem like a legitimate institution, such as a bank or a government entity.

Most people who have a phone have received some sort of vishing attack. It has become such a regular occurrence, that most people have become wary of giving out personally identifiable information over the phone.

Although this is good practice, it can also lead many people to be overly suspicious when they do receive a call that is in fact legitimate. But determining the legitimacy of a vishing attack can be rather tricky.

How to Spot Vishing Attacks

The first step to spotting a vishing attack is to inspect the phone number where the call originated. A phone number that is strikingly similar to your own phone number is probably spoofed to look more legitimate. If you aren’t familiar with the number, the best advice is to ignore the call and let it go to voicemail.

As stated, most vishing attacks use pre-recorded or automated messages. If you do answer the call and you are immediately greeted by a recording, it’s likely that the call is fake. However, if you aren’t sure if the call is legitimate or not, the best way to be sure is to look up the phone number of the institution that’s claiming to be behind the call, and call them yourself.

If you answer the call and it’s a real person on the other line, you should be wary of giving out any information they don’t already have. For example, if someone calls and says that your credit card information has been compromised but they don’t have the credit card number itself, they are likely hoping that you will give them all the information they need to steal your credit card number themselves.

How to Prevent Vishing Attacks

The best way to prevent a vishing attack is by simply not answering your phone. If the attacker leaves a message with a return number, check the legitimacy of the number before you dial. Even better, look up the number of the supposed institution and call them yourself.

These days, many smartphones have call filters that alert you when a caller is suspected of spam. However, these filters don’t work all the time, so it’s up to you to determine whether a call is legitimate or not and whether you should divulge your personal information via phone call.

---

Evil Twin Phishing

This type of phishing attack involves a threat actor setting up what appears to be a legitimate WiFi network that lures users to a phishing site when they connect to it. The malicious WiFi network might closely resemble the WiFi network your employees usually connect to, and will prompt users to enter their login credentials when they sign on to the network.

Once the hacker has this information, they can use it to log into the real WiFi network themself, take control of it, monitor unencrypted traffic, and find ways to steal sensitive information and data.

Another form of evil twin phishing occurs when a malicious actor sets up evil twin access points in areas that are serviced by public WiFi — for instance, in a coffee shop. By ensuring that the signal of the evil twin is stronger than the authorized network, the malicious actor can trick users into choosing the network with the stronger connection over the legitimate offering.

How to Spot Evil Twin Phishing Attacks

Always double check to make sure you’ve selected the correct WiFi network when logging into a device. Similarly, if you’re in a public place, you should check with the establishment what the name of the official hotspot is to prevent you from making incorrect assumptions and choose a malicious WiFi network.

As a general rule, you should always disable the “auto connect” or “auto join” functions for saved hotspots for all of your wireless devices. You should also manually disconnect from a hotspot every couple of hours and manually connect to your desired hotspot and type in the password to confirm the connection.

How to Prevent Evil Twin Phishing Attacks

To prevent others from connecting to a malicious WiFi network that’s impersonating your own WiFi network, you should clearly advertise the name of the wireless network you provide in a prominent location.

Rather than providing open WiFi, you should protect your hotspot with a Personal Security Key (PSK) and create a system to provide the key to any customers or employees who might need to use it. You can also look for hotspots that are impersonating your official ones using your own mobile device, and alert customers and employees if necessary.

---

Social Media Phishing

As social media becomes more ubiquitous, it’s unsurprising that it would be used by malicious actors for financial gain. Attackers often use social networking sites like Facebook, Twitter and Instagram to obtain victims’ sensitive data or lure them into clicking on malicious links.

To execute social media phishing attacks, threat actors might create a fake account impersonating someone the victim knows to lead them into their trap. Or, they may even impersonate a well-known brand’s customer service account to prey on victims who reach out to the brand for support.

With the proliferation of social media contests that result in a prize, many hackers are taking advantage of these campaigns and creating fake accounts that impersonate the account conducting the contest. For example, if you enter a contest that randomly selects a winner from the comments section of a post, you might receive a direct message from an account that looks like the account that posted the contest. This message might say “you won!” and request additional information, like credit card information, so you can collect your prize.

Most of the time, the original account that posted the contest is made aware of fake accounts pretending to be the official poster, and can warn users not to provide any personal information to claim their prize. However, sometimes these accounts can slip through the cracks, even if they are reported as false.

How to Spot Social Media Phishing Attacks

In many cases, if you receive a message from someone you know that doesn’t sound like them, their account has probably been hacked. One of the most common ways that social media phishing attacks get users to click on malicious links is by luring them with something outrageous like, “OMG… did you see this video? I can’t believe you did this!” with a link to the supposed video.

Alerting a user that their account has been hacked is the best way to prevent these types of social media phishing attacks from reaching the masses. You can also block users who appear to be fraudulent so their messages never reach you to begin with.

How to Prevent Social Media Phishing Attacks

The best way to prevent social media phishing attacks is to only accept friend requests from people you actually know. This will help eliminate any fraudulent accounts that are looking for easy targets — ie., people who regularly accept requests from people they don’t know.

You should also always check the legitimacy of any accounts that are supposedly associated with official businesses. Most accounts that have been verified by the social media platforms themselves will have a blue checkmark next to the username. If you receive a message from anyone other than a verified user, this should immediately raise a red flag.

---

Search Engine Phishing

This type of phishing attack uses search engines to direct users to fraudulent webpages that are indexed on legitimate search engines like Google. These websites typically feature cheap products or incredible deals to lure online shoppers who see the website on a search engine result page.

When the user visits the page, they’re usually prompted to register an account or enter their bank account information to complete a purchase. Once they’ve entered this information, threat actors can turn around and use this data for financial gain or identity theft.

In 2020, Google reported that 40 billion spam pages were detected every day, from spam websites to phishing websites. Additionally, Wandera reported in 2020 that a new phishing site is launched every 20 seconds. This means that three new phishing sites appear on search engines every minute.

How to Spot Search Engine Phishing

Again, you should always check to make sure that the URL you’re visiting is secured with a digital certificate. You should also avoid entering any personally identifiable information on a website unless it provides a secured method for entering such information.

Generally, websites that appear in search engine phishing attacks will be obvious. If the deal seems too good to be true, it probably is. Only making purchases from verifiable websites with reputable brands behind them is a good rule of thumb.

How to Prevent Search Engine Phishing

The best way to prevent this type of phishing attack is to avoid using search engines to find the products you’re looking for. Visit websites directly, and avoid entering any financial or personal information unless you’re absolutely certain that the source is credible.

---

Pharming Attacks

Pharming — a combination of the words “phishing” and “farming” — occurs when hackers exploit the mechanics of internet browsing to redirect users to malicious websites, often by targeting Domain Name System (DNS) servers.

DNS servers direct website requests to the correct IP address, and hackers who engage in pharming often target these servers to redirect victims to fraudulent websites with fake IP addresses. When a user lands on a website with a corrupted DNS server, their personal data can become vulnerable to theft.

How to Spot Pharming Attacks

Unfortunately, this type of phishing attack is the most difficult to spot because it essentially tricks the system into thinking that the IP address is legitimate, when in fact, it is not. The easiest way to spot a pharming attack is by checking that the url is connected securely by looking for “https” in the web address.

How to Prevent Pharming Attacks

A good place to start is to install and run reputable antivirus and anti-malware security software with browser monitoring to help detect malware threats and protect your devices against threats. You can also enable two-factor authentication on any sites that offer it, and only use a reputable internet service provider or a VPN service that has reputable DNS servers. If you suspect that you’re already a victim of pharming, you can try resetting your computer to reset your DNS entries.

Safeguard Your Business from Phishing Attacks with Reciprocity ZenRisk

The easiest way to prevent phishing attacks is to utilize some of the many security tools available to your organization. However, choosing the right tool can be a daunting task in itself. Fortunately, there are solutions designed to help.

Reciprocity® ZenRisk is an integrated cybersecurity risk management solution designed to provide you with actionable insights to gain the visibility you need to stay ahead of threats and clearly communicate the impact of risk on high-priority business initiatives. Turn the unknown into quantifiable and actionable risk insights with built-in expertise that identifies and maps risks, threats and controls for you, so you can spend less time setting up the application and more time using it.

A single, real-time view of risk and business context allows you to clearly communicate to the board and key stakeholders in a way that’s framed around their priorities, keeping your risk posture in sync with the direction your business is moving. Reciprocity ZenRisk will even notify you automatically of any changes or required actions, so you can be on top of your risk posture like never before.

Plus, Reciprocity ZenRisk is seamlessly integrated with Reciprocity ZenComply so you can leverage your compliance activities to improve your risk posture with the use of AI. Built on the ZenGRC, the Reciprocity product suite gives you the ability to see, understand and take action on your IT and cyber risks.

Now, through a more proactive approach, you can stay ahead of threats like phishing with Reciprocity ZenRisk. Talk to an expert today to learn more about how the Reciprocity Product Suite can help your organization mitigate cybersecurity risk and stay ahead of threats.

Risk has always been an inevitable part of doing business. How organizations identify, manage and mitigate those risks ultimately determine whether or not they will survive after a disruption. To help your organization better prepare for and respond to risks when they occur, you’ll need a comprehensive risk management program.

At the core of your risk management program is the risk management process, which consists of an ongoing series of activities including risk identification, risk assessment, risk analysis, risk prioritization, risk mitigation, and risk monitoring. Although all these steps are important to an effective risk management program, there’s one in particular that’s especially critical.

Risk mitigation, or the process of determining how to address a particular risk once it’s been identified, means choosing between risk acceptance, risk avoidance, risk transfer, or risk reduction.

These are the four most common strategies for risk mitigation, but there are, of course, many more to choose from. To learn more, you can check out this article for eleven risk mitigation strategies.

A more proactive approach to risk mitigation involves implementing something called internal controls with the goal of avoiding or minimizing loss to your organization.

In this article, we’ll explore why internal controls are important, what makes them effective, as well as some of the common internal controls used today. Armed with these best practices, you will be able to develop the best internal controls for cyber risk mitigation for your organization.

What are Internal Controls and Why are They Important?

Internal controls are the policies and procedures or technical safeguards that are put in place to prevent problems and protect assets. The very first common definition of “internal control” was documented in the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) 1992 framework for internal control: Internal Control–Integrated Framework.

In their framework, COSO defines “internal control” as “…a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.”

In addition to this definition, COSO’s framework also provides a system that organizations can use to assess their own internal controls’ effectiveness.

While fraud deterrence is the main impetus behind the formation of the COSO framework and the main reason organizations use it today, there are a number of other reasons you might consider using it as the benchmark for implementing internal controls within your own organization:

• Safeguarding your assets. Internal controls protect your assets from accidental loss or loss from fraud.
• Ensuring the reliability and integrity of your financial information. Internal controls ensure that management has accurate, timely, and complete information to plan, monitor and report business operations.
• Achieving compliance. Internal controls help organizations stay compliant with federal, state and local laws and regulations affecting operations.
• Promoting efficient and effective operations. Internal controls provide an environment in which managers and staff can maximize the efficiency and effectiveness of operations.
• Accomplishing goals and objectives. Internal controls provide a mechanism for management to monitor the achievement of operational goals and objectives.

There are a number of different internal controls you can implement to help your organization achieve any one of these objectives, but typically, internal controls are categorized into three main types: detective, preventative and corrective.

Detective internal controls are controls that are used after a discretionary event to try to piece together what happened. Examples of detective internal controls include internal audits, reviews, reconciliations, financial reporting, financial statements, and physical inventories.

Preventative internal controls are controls that are put into place to avert a negative event before it occurs and to avoid asset loss. These include both physical controls or administrative preventative controls like segregation of duties, training programs, drug testing, firewalls, and computer and server backups.

Corrective internal controls are controls that are put in place after the detective internal controls discover a problem and uncover the reasons behind its occurrence. This includes disciplinary action, reports filed, software patches or modifications, and new policies prohibiting practices such as employee tailgating.

Which particular internal controls you choose to implement within your organization will ultimately depend on your particular needs and industry standards.

Fortunately, there are a number of existing frameworks and standards that are available to business owners who want to create their own internal control framework but aren’t sure where to start.

One such framework is the COSO framework mentioned above, which is designed to help organizations ensure that their financial statements are accurate, their assets and stakeholders are protected from fraud, and their operations are running efficiently and effectively.

When it comes to cyber risk, information security controls include access controls such as restrictions on physical access such as security guards at building entrances, locks, and perimeter fences; procedural controls such as security awareness training education, security framework compliance training, and incident response plans and procedures; technical controls such as multi-factor user authentication at login and logical access controls, antivirus software and firewalls; and compliance controls such as privacy laws and cybersecurity frameworks and standards.

Without internal controls in place, your organization is vulnerable to a higher number of risks, including cyber risks. Internal controls help prevent these risks from taking place in the first place. Should a risk occur, internal controls help locate the origin of those risks as well as helping to reduce any risks that have already been identified. Overall, internal controls are something that your business simply shouldn’t operate without.

There are, of course, some limitations to internal controls. First, processes and control activities are never perfect, and problems are likely to occur along the way. For this reason, it’s important to have ongoing review and analysis of your internal controls as part of your regular processes. When a problem does occur, it should be documented and reviewed by those who can take the corrective actions to improve the system.

Finally, systems involving humans will always have limitations. People make mistakes and often find weaknesses in control procedures — either by accident or intentionally.

So, what makes an internal control effective? Next, we’ll introduce some of the most important elements of effective internal controls and some examples of common internal controls used today.

What Makes an Internal Control Effective

To be most effective, internal controls rely on the responsibilities of both management and staff for proper execution. Generally, management is responsible for maintaining the system of internal control and communicating the expectations and duties to staff. Staff and operating personnel are responsible for carrying out those internal control activities set forth by management.

The framework of a good internal control system should include the five components of internal control as defined by COSO, which are:

• A sound control environment. This is created by management through communication, attitude and example and should include a focus on integrity, a commitment to investigating discrepancies, diligence in designing systems and assigning responsibilities.
• A thorough risk assessment. This involves identifying the areas in which the greatest threat or risk of inaccuracies or loss exist — the greatest risks should receive the greatest amount of effort and level of control.
• Continuous monitoring and reviewing. This means management should periodically review your system of internal control to assure that internal control activities have not become obsolete or lost due to turnover or other factors, as well as enhancing internal controls to remain sufficient for the current state of risks.
• Open information and communication. This includes making information available and creating a clear and evident plan for communicating responsibilities and expectations.
• Detailed control activities. These are the activities that occur within an internal control system and include the policies and procedures as well as any daily activities.

Within COSO’s framework, each of these components includes principles with supporting “points of focus” to help with designing, implementing, conducting, monitoring, and assessing your internal control processes.

Although COSO is the United State’s most widely used framework for internal controls, compliance can be challenging and expensive. But it’s not nearly as costly or difficult as recovering from fraud, theft, reputational loss, or legal penalties. COSO compliance is voluntary, but it’s an investment that will eventually pay for itself in the long-run.

Now let’s take a look at some of the common internal controls used today and the best practices for executing an effective internal control system.

Proper Authorization

Authorization is a process that involves establishing a basis by which various employees have the authority to execute certain types of transactions and serves as a proactive approach for preventing invalid transactions.

This includes approval authority requirements which require specific managers to authorize certain types of transactions, adding a layer of responsibility to your records systems by proving that the transactions have been seen, analyzed, and approved by the appropriate authorities.

For instance, requiring approval for any large payments and expenses can deter employees from making fraudulent transactions with company funds.

To implement authorization, you’ll first need to document the level of authority and create an expectation of responsibility and accountability. Your policies and procedures should clearly identify which individuals have authority to initiate, submit, reconcile, view, or approve different types of transactions. The authority to perform a particular action can manifest as hard copy documents or system generated authority.

Individuals with authority should have first hand knowledge of the transactions being approved, or they should be able to review supporting documents to verify the validity and appropriateness of transactions. To make sure authorized employees are well informed, you should provide the proper training and inform them of any departmental procedures related to internal controls.

It’s important that authorization is also timely, as workflow is an important aspect of good internal controls. Any time lags between approval and processing give fraudsters opportunities to alter documents, and many of these falsifications occur after the approval of a transaction. In short, once a document has been approved, it should not be returned to the preparer.

Segregation of Duties

Segregation of duties is the means by which no one person has sole control over the lifespan of a transaction. According to the American Institute of Certified Public Accountants (CPA), segregation of duties means “shared responsibilities of a key process that disperse the critical functions of that process to more than one person or department” to reduce the risk of fraud and errors.

Ideally, no one person should be able to initiate, record, authorize and reconcile a transaction. All organizations should separate functional responsibilities to assure that mistakes, intentional or otherwise, cannot be made without being discovered by another person.

The segregation of duties will ultimately depend on the side of your organization and its structure. Duties may be segregated by department or by individuals within a department, and the level of risk associated with a transaction should determine the method for segregating duties.

This is another process that should be demonstrable to an outside party via documentation, including explicitly stating who will initiate, submit, process, authorize, review and reconcile each activity. If it’s difficult to sufficiently segregate duties, you should increase management’s review and oversight functions to assess the potential for mistakes or fraudulent transactions.

Standardized Documentation

Documentation includes paper and electronic communication that supports the completion of the transaction lifecycle. It’s anything that provides evidence of a transaction, who has performed each activity pertaining to a transaction, and the authority to perform such activities.

Documents provide a financial record of events and activities, and therefore, they ensure the accuracy and completeness of transactions. This includes expenses, revenues, inventories, personnel, and other types of transactions. The proper documentation can provide evidence of what has transpired as well as providing information for researching any discrepancies.

Standardizing documentation used for financial transactions can help maintain consistency in record keeping over time, and it can also make it easier to review past records when searching for the source of a discrepancy in your system. Ultimately, a lack of documentation standardization can lead to overlooking or misinterpreting important information.

Establish a well-designed, uniform format to help ensure the proper recording of transactions. You should consider consistently using standard forms or templates for email approvals, departmentally created supporting documentation, time reporting, reimbursement logs, invoice, and any other financial documents.

Define clear ownership of entity-owned documentation so it’s never mistaken as personal property of your employees. Whenever possible, do not allow your employees to take business documents home unless business needs require them to do so. In these cases, you should communicate to employees that it is their responsibility to keep documentation secure, and particularly so for documentation containing personal or sensitive information.

Create a method that will help you avoid duplicating processing, especially in regards to transactions that result in payments to individuals such as payroll, petty cash, and travel reimbursements. Always check for duplicate payments and insist on an environment in which payments are processed in a timely manner — long delays in processing create opportunities for duplicate payments to go unnoticed.

Pay close attention to retention policies for all types of supporting documentation, and always keep documents for the appropriate retention period and no longer. Establish a process for purging documents that have reached the end of their retention period, and document who, when and how each record type should be purged.

Occasional Reconciliation

Reconciliation is the process of comparing transactions and activities with supporting documentation and involves resolving any discrepancies that have been discovered. Occasional reconciliation ensures that the balances in your systems match up with the balances in the systems held by other entities, including banks, suppliers, and credit customers.

For example, a bank reconciliation involves comparing cash balances and records of deposits and receipts between your accounting system and bank statements. Any differences between these types of complementary accounts can reveal errors or discrepancies in both your own accounts, or in the accounts of other entities.

A good internal control system should provide a mechanism to verify that transactions and activities are for the correct purposes and amounts, and that they are allowable. For each type of activity, you should consider documenting the particular information from source documents that can be compared to the appropriate report.

You also need to ensure that transactions have been properly authorized, and so you should review all documents for any potential changes between approval and processing, and especially if the source documents are paper based.

Any errors or discrepancies, whether intentional or unintentional, should be detected, investigated and resolved as quickly as possible. This involves verifying the recording of transactions and reviewing the source documents to assure that they are processed and posted correctly and in a timely manner. If they aren’t then you should follow up with the appropriate central office or processing department to correct the issue.

Reconciliation processes are best when they’re consistent and thorough. Any employees who are involved in the process should be knowledgeable and clear on their responsibilities and expectations. It should also be clear to an external reviewer or auditor when a reconciliation has been completed.

Be consistent with your reconciliation process, as making changes often leads to undiscovered inaccuracies and potential for fraud. Your reconciliation process should be clearly documented, and should include the steps in the process; who performs each step; the expectations regarding timeliness; a mechanism for providing proof that all activity has been reviewed and reconciled; and a procedure for error correction.

Strict Security Measures

The security of assets and data includes three different types of safeguards: administrative, physical and technical. Administrative security focuses on the departmental processes that are put in place to protect assets and data. Physical security is the protection of physical data and assets from loss by theft or damage. Technical security is the protection of electronic data loss by theft, damage, or loss in transport.

Ideally, assets and data should be kept secure at all times to prevent unauthorized access, loss, or damage. The security of your assets and data is essential for ongoing operations, accuracy of information, privacy of personal and sensitive information, and in many cases is state or federal law.

First, you’ll need to designate a point person for all areas or individually for the three types of security to encourage responsibility and accountability for the proper security procedures.

For administrative security, you should keep an up-to-date chart that defines the reporting relationships as well as responsibilities (including back-up responsibilities) regarding internal controls. We recommend documenting such processes such as opening and distributing the mail, administration of keys, access to documents, and other administrative controls.

For physical security, you should limit access to data and assets to only those who have a business related need for them. Do not allow employees to download data to mobile workstations and transported outside the office, and keep your most important physical documents in lockable, fireproof storage.

For technical security, you should also limit access to data and assets to only those who have a business related need for them. This includes setting up password protected access to electronic records as well as employing identity access management (IAM) to limit access to sensitive areas of a system or network to only the people who need it.

System access controls control access to different parts of your system via passwords, lockouts, and electronic access logins to keep unauthorized users out of your system while providing a way to audit the usage of your system and to identify the source of any errors or discrepancies. This kind of robust access tracking can also serve to deter attempts at fraudulent access in the first place.

If you’re experiencing employee turnover, you should develop and use a checklist for removing access to networks, systems, and data upon separation of an employee or upon transfer. Develop a process and assign a point person the responsibility of administering the process for deleting access to data.

Mitigate and Manage Risks More Efficiently with Reciprocity ZenRisk

Between risk assessments, procedures, reporting and communication — paperwork is the one thing that all internal control frameworks share in common. While small businesses may use spreadsheets to track their controls, it’s a process that will eventually become unmanageable without the right solution to help.

Reciprocity® ZenRisk is an integrated cybersecurity risk management solution designed to provide you with actionable insights to gain the visibility you need to stay ahead of threats and clearly communicate the impact of risk on high-priority business initiatives. Turn the unknown into quantifiable and actionable risk insights with built-in expertise that identifies and maps risks, threats and controls for you, so you can spend less time setting up the application and more time using it.

A single, real-time view of risk and business context allows you to clearly communicate to the board and key stakeholders in a way that’s framed around their priorities, keeping your risk posture in sync with the direction your business is moving.

Reciprocity ZenRisk will even notify you automatically of any changes or required actions, so you can be on top of your risk posture like never before. Eliminate time-consuming, manual work and streamline collaboration by automating workflows and integrating with your most critical systems.

Plus, Reciprocity ZenRisk is seamlessly integrated with Reciprocity ZenComply so you can leverage your compliance activities to improve your risk posture with the use of AI. Built on the ZenGRC, the Reciprocity product suite gives you the ability to see, understand and take action on your IT and cyber risks.

Now, through a more proactive approach, you can give time back to your team with Reciprocity ZenRisk. Talk to an expert today to learn more about how the Reciprocity Product Suite can help your organization mitigate cybersecurity risk and stay ahead of threats.

Malware is a threat for businesses everywhere. Short for “malicious software,” malware is any intrusive program that exploits system vulnerabilities to wreak havoc on a computing system. You need robust malware detection tools to prevent this from happening to your business.

Even the best malware detection methods can fall short, however, because malware is constantly evolving. New malware variants are developed all the time, and cyber criminals frequently change their tactics and techniques.

How can you stay ahead of these threats? There is one state-of-the-art malware detection system you can use: deep learning.

This article explores how deep learning and artificial intelligence can help you uncover malware threats and thwart them before they can damage your organization.

Why Is it Critical to Detect and Mitigate Malware?

A malware infection can be disastrous for your organization. It can cripple your network and systems, as well as destroy, delete, corrupt, or exfiltrate your sensitive data.

Malware is also exceedingly dangerous because it comes in many forms. Worms, Trojans, viruses, bots, and adware are some types of malware that attackers can use to damage your organization.

Another malware variant popular with cyber criminals is ransomware. Ransomware attacks increased by 93 percent from 2020 to 2021, affecting companies, governments, and supply chains worldwide.

Your organization needs to update its detection and mitigation strategies to keep up with these sophisticated and ever-more frequent malware threats. One such strategy is deep learning.

What Is Deep Learning?

Deep learning is a machine learning (ML) technique. ML is the idea that machines can be taught to “learn” and think like humans. In ML, a computer model or algorithm learns how to perform specific tasks to achieve a particular goal.

The computer may learn how to drive a car, distinguish and classify objects, or translate text from one language to another. Machine learning algorithms are trained with a large set of labeled training data to produce more and more accurate results over time.

Unlike many machine learning models, deep learning models eliminate data pre-processing tasks. This means they ingest and process unstructured data such as text and images, to extract features from this data without the need for human inputs.

Deep neural networks, also known as artificial neural networks (ANN), are an essential component of deep learning applications. An ANN is a type of advanced ML algorithm that tries to mimic the human brain to recognize, classify, and describe objects within a dataset.

The deep in deep learning refers to the number of layers in the ANN. Where traditional neural networks contain two to three hidden layers, deep networks can have as many as 150. ANNs with a single layer can still make predictions, albeit approximate ones. Adding more hidden layers increases the accuracy of the model’s predictions.

Deep learning is already used in many artificial intelligence (AI) applications to power industrial automation and automate analytical and physical tasks. Deep learning models aid with language translations, medical diagnoses and research, computer vision and image recognition, and even law enforcement.

These learning methods also power many existing and emerging products, such as:

• Digital assistants;
• Chatbots;
• Voice-enabled TV remotes;
• Self-driving cars.

In recent years, many enterprise security solutions have adopted the deep learning approach to detect and address malware.

Deep Learning for Object Recognition and Image Classification

Convolutional neural networks (CNNs), a type of ANN, are often used for image processing and identification applications. There’s no need to manually identify or extract image features with convolutional networks. A human operator is not required to define the patterns the model should look for in the image.

Instead, the model will learn patterns in the images, extract features from them, and classify data into various classes. This automated feature extraction capability also makes CNNs and deep learning valuable for malware detection, classification, analysis, and evasion.

How Deep Learning Is Used to Detect Malware

The data-driven deep learning process involves CNNs looking at and learning from the raw bytes of Windows Portable Executable (PE) files. PE files are used for executables (.EXE, .SCR) and dynamic link libraries (.DLL) in Windows-based systems.

By looking at a training set of PE files, CNNs can accurately detect and classify malware. In fact, CNNs can be applied to many use cases in malware analysis using bytes sequence, grayscale images, API call sequence, structural entropy, and HTTP traffic.

A CNN looks at raw bytes to identify new patterns without completing domain-specific feature extraction or pre-processing. It then performs “representation learning” to identify patterns across malware families, learn their features automatically, and detect and classify malware.

The malware’s low-level features are detected by the early layers of the CNN. Subsequent convolutions layers combine these features into a more complete representation of the malware.

Supervised Deep Learning to Detect Malware

In supervised deep learning, both the data and the right answers for each object in the dataset are available. The objects are represented with a feature that relates to file content or behavior, such as file statistics or a list of API functions used.

Each object is also mapped to the correct answer that’s labeled. This label could be a benign file, or it could be malware. It can also have a more precise classification such as “trojan,” “adware,” “ransomware,” “virus,” and so forth.

Supervised deep learning consists of two stages:

1. Train a model and fit it to available training data;
2. Apply the trained model to new malware samples and make predictions and decisions.

During training, both benign and malicious executables are used to train the model and make it more predictive. Importantly, at this phase the model only produces predictions. It does not make decisions about the potential malware nature of an unknown executable.

After the model is trained, it makes autonomous decisions for malware detection based on its predictions about whether the executable is benign or malware.

With a large enough dataset, the model can be trained to read any new malware sample or object. For this, effective processes are vital to collect and label new samples, enrich training datasets, and perform model retraining.

Important Considerations for Supervised Deep Learning and Malware Detection

The ability of a deep learning classification model to detect malware accurately depends on a few considerations.

It’s crucial to select suitable training models such as neural networks or decision trees to give the most accurate answers over the set of reference objects. It’s also important to focus on low false-positive rate (FPR) models, where the FPR can be fixed easily without having to retrain the model.

Mistakes in this area could result in profound unwanted consequences. For example, the malware may not be adequately detected and may infect its target system. Or an OS driver might get removed by mistake, affecting the system’s operations.

It’s also essential to train the models on data that correctly represents or mimics the real-world conditions where the model will actually work. This representative dataset helps the model determine which features are relevant to accurately identify the malware.

Benefits of Deep Learning Malware Detection

Traditional ML-based malware classification and detection models rely on handcrafted features selected based on human inputs. Although essential, feature engineering can be time-consuming and costly. Plus, handcrafted features sometimes don’t generalize well to novel malware.

CNNs are helpful for automated malware detection and analysis. The raw bytes model eliminates the need for feature selection or engineering since it automatically performs end-to-end malware classification with real-world data. Moreover, it can identify malware families as well as novel malware threats and advanced malware attacks.

Once the model is trained, it captures the various characteristics of different types of malware, which informs your organization’s cybersecurity and malware detection program.

With an appropriate dataset and the right amount of training, CNN models can be applied for early malware identification, categorization, and triage. This is essential for optimal threat prioritization and to guide mitigation efforts.

With visualizations, heatmaps, and gradient activation, human analysts can get insights into CNN decisions. These insights help identify patterns across malware families and improve their malware analysis and classification capabilities.

Reduce the Risk of Malware Attacks With ZenGRC

With deep learning-powered malware detection, your organization can keep the threat of malware at bay. Alongside deep learning, your computer security arsenal should also include a comprehensive risk management platform such as ZenGRC.

The ZenGRC platform provides a single source of truth to help you track malware threats, build a strong cybersecurity foundation, and reduce cyber exposure. With ZenGRC insights and metrics, you can better understand the malware threat and adversarial landscape to protect your systems and secure your data.

To see how ZenGRC can help safeguard your business from malware, schedule a demo.

In today’s digital age, organizations know the importance of preparing for cyber attacks and data breaches. Too many, however, focus only on outside cybersecurity threats, even though insider threats are very common.

In fact, according to one Ponemon Institute survey, the number of insider incidents spiked by 47 percent from 2018 to 2020. The total cost of insider threats increased from $8.76 million to $11.45 million, and cost organizations more than $700,000 per incident. Insider security threats are a huge challenge for organizations because such threats are hard to detect and even harder to eliminate.

The good news is that companies can minimize this risk. First they must understand the sources of these threats, and then implement strong security measures to stay one step ahead.

This article deep dives into the problem of insider threats and explores seven real-world insider threat examples to help guide your threat prevention and data security strategies.

What Is an Insider Threat?

An insider threat comes from a trusted individual or privileged user who is authorized to access your organization’s IT assets and information. These users could include insiders such as employees; or outsiders, such as vendors, contractors, associates, or business partners.

Any of these users may deliberately or accidentally leak sensitive information, exfiltrate company data, or compromise enterprise systems, leaving them vulnerable to attack. A trusted insider with continued access to sensitive data can pose a security risk even if the insider is no longer associated with the company.

Insider threats can damage your organization in many ways:

• Data theft
• Disclosure of trade secrets
• Business disruptions affecting productivity and profitability
• Financial losses
• Reputational damage
• Loss of customer trust
• Regulatory fines
• Lawsuits
• Loss of competitive edge
• Falling share prices

To protect your organization, you need to take security precautions to mitigate the risk of insider threats. You should also limit access to enterprise assets whenever possible and monitor what users with legitimate access can do with the resources they’re permitted to access.

It’s also crucial to educate employees on good cybersecurity practices, to create a cyber-aware culture and reduce the risk of insider security incidents.

We will explore these strategies in detail in a later section. First let’s understand the source of insider threats and look at some real-life insider threat examples.

Types of Insider Threats

Three types of insider threats may affect your organization:

• Malicious insiders
• Negligent insiders
• Compromised insiders

Malicious Insiders

Malicious or criminal insiders purposefully damage IT systems, steal trade secrets or intellectual property, breach data, or do something that increases the risk of a cyber attack.

They may be ex-employees who were fired for poor performance, disgruntled employees seeking revenge, or existing workers coerced into carrying out a cyberattack by a competing firm or a nation-sponsored hacker.

Malicious insider threats are hard to predict and detect because companies usually don’t have enough information about them. While malicious insider threats account for only 14 percent of incidents, it is still significant enough to warrant concern.

Negligent Insiders

Negligent insiders are the most common insider threat. They account for the solid majority (62 percent) of incidents and are responsible for the highest average cost per incident ($4.58 million).

These people unintentionally introduce security weaknesses into the organization. They lack malicious intent, such as revenge, cyber-extortion, corporate espionage, or the expectation of financial gain. They do still increase security risks, however, because they are careless, don’t practice good cybersecurity hygiene, or are unaware of the dangers created by their actions.

For example, an employee may connect a malware-infected USB device to a business computer. Or he or she might use weak passwords that allow threat actors to gain unauthorized access to enterprise systems or exfiltrate enterprise data.

Compromised Insiders

In this context, the word “compromised” does not mean pressured by external parties via, say, blackmail. Here we mean “compromised” as in using compromised technology. Like negligent insiders, compromised insiders are rarely malicious. They can cause serious cybersecurity issues, due to:

• Risky actions
• Lack of awareness
• Lack of cybersecurity hygiene
• Stolen credentials

For instance, a compromised insider may click on an infected link and enter his or her login credentials into a fake website that attackers can then steal and use to attack the organization.

In 2020, 89 percent of hacking attempts into web applications involved credential abuse or theft. Or a compromised user may download a malware-infected attachment from a phishing email, allowing cybercriminals to hack into your network to compromise it.

7 Real-Life Examples of Insider Threats

1. The negligent Microsoft employees whose actions led to the leak of a customer support database

   Background

   In 2019 Microsoft employees made misconfiguration errors on a new version of Azure security rules. They were lax about monitoring user records and activity with sensitive assets. In addition, they didn’t limit access to a customer support database with a strong password or two-factor authentication.

   What Happened

   The database leaked on the Internet and remained publicly accessible for an entire month. It contained 250 million customer entries accumulated across 14 years, including customers’ locations, email addresses, and details about support cases.

   Results

   Microsoft fixed the leak on the same day the leak was discovered. It also notified affected users, so it suffered no fines or penalties. The California Consumer Privacy Act took effect in early 2020. If Microsoft had delayed its actions by even a few days, the company could have been fined millions of dollars.

2. The Marriott employees whose credentials were stolen to exfiltrate customer data

   Background

   Cyberattackers compromised the credentials of two Marriott employees to log into a third-party application. They remained active for two months but managed to evade Marriott’s cybersecurity systems, mainly because third-party monitoring and user and entity behavior analytics (UBA) were not in place.

   What Happened

   Between early January and late February 2020, the attackers gained access to the personal data of 5.2 million Marriott guests, including their:

   • Contact information
   • Gender
   • Birthday
   • Personal preferences
   • Loyalty account details
   • Partnerships and affiliations

   It wasn’t until the end of February that Marriott’s security team noticed the suspicious exfiltration activity and sealed the security breach.

   Results

   Marriott informed all guests whose data was stolen and set up a dedicated website to provide information to affected guests. Marriott had already suffered earlier breaches in 2014 and 2018, for which it was fined $24 million (£18.4 million) by the U.K. Information Commissioner’s Office (ICO) in 2020.

   The 2020 breach included personally identifiable information, so Marriott will likely face monetary penalties once again.

3. The employees who stole General Electric’s trade secrets to start a new company and compete with their ex-employer

   Background

   From 2008 to 2019, two employees of General Electric (GE) stole company trade secrets by downloading thousands of files from company servers, uploading them to their private cloud, and sending the data to personal email addresses.

   What Happened

   The stolen data included valuable information on advanced computer models, pricing, and marketing information. The insiders used this information to start a new engineering company and compete with GE on tenders for new projects. GE’s cybersecurity system failed to detect these malicious activities even though they went on for several years.

   Results

   GE lost several tenders to the new company, although GE didn’t know that its former employees founded the company. When GE discovered the scam, it reported the incident to the FBI. In 2020, one of the ex-employees was sentenced to two years in federal prison and fined $1.4 million. The other was also fined and sentenced to one year in prison.

   There was another insider attack at GE in 2017 when an engineer conspired with a Chinese businessman to steal trade secrets for their own startup. The engineer was indicted in 2021.

4. The Cisco Systems ex-employee who purposely damaged its cloud infrastructure

   Background

   In 2018, Cisco’s cloud infrastructure was not protected with reliable access management tools or two-factor authentication mechanisms. Knowledge of these weaknesses allowed a malicious ex-employee to access the infrastructure and deploy malicious code.

   What Happened

   With the code, the attacker deleted 456 virtual machines used for Cisco’s WebEx Teams application, which locked out 16,000 WebEx users from their accounts for two weeks.

   Results

   When the incident was discovered, Cisco audited its infrastructure and fixed the damage, spending about $1.4 million in employee time and another $1 million in restitution costs to affected users.

5. The Tesla employee who took advantage of his access and privilege to sabotage the company

   Background

   In 2018, a Tesla employee used fake usernames to change the code used in the company’s manufacturing operating system. He also exported large amounts of sensitive data (gigabytes’ worth), including trade secrets, to unknown third parties.

   What Happened

   The motive for the attack was revenge. The attacker wanted a promotion that he did not receive. He used his insider privileges to cause extensive and damaging sabotage against the company.

   Results

   Following the sabotage and data leak, Tesla’s share prices fell by 5 percent and delayed a production ramp-up.

   Tesla faced another insider threat in September 2020 when a foreign national attempted to “recruit” an employee to transmit malware onto Tesla’s network to exfiltrate sensitive data.

6. The Twitter employees who got phished and unwittingly participated in scamming hundreds of Twitter users

   Background

   In July 2020, a few Twitter work-from-home employees were the victims of a targeted spear-phishing attack. Hackers gathered information about them via “vishing” (voice phishing) to compromise their credentials and gain access to administrator tools.

   What Happened

   The tools allowed the hackers to access 130 private and corporate accounts of famous Twitter users, including Barack Obama, Elon Musk, and Jeff Bezos. The attackers then:

   • Changed these users’ credentials
   • Tweeted scam messages to millions of their followers
   • Promoted a Bitcoin scam
   • Transferred $180,000 worth of Bitcoin to scam user accounts

   The attackers almost got away because Twitter didn’t notice their suspicious activities in the admin tool until the scam messages were already published. They also did not have privileged access management or UBA in place to protect and detect unauthorized activities.

   Results

   The incident was the most high-profile data breach at Twitter and led to a 4 percent fall in the company’s stock price.

7. The employee who sold Bupa’s customer data for financial gain

   Background

   In 2017, an employee stole more than 500,000 customer records and sold them on the dark web. He extracted this data from Bupa’s CRM system, which at the time contained 1.5 million records.

   What Happened

   The employee accessed the system, copied the information, and then deleted it from the database before selling it. The data included names, birthdates, email addresses, and nationalities of Bupa customers from 122 countries.

   An investigation revealed that the attacker had been accessing customer data since 2013. He saved three datasets, including credit card details to his desktop and sent some information via email to his personal account.

   Bupa’s mistake was giving too many people access to large volumes of data. The company also didn’t monitor logs, so they were unable to detect suspicious activities like this one.

   Results

   Britain’s ICO fined Bupa £175,000 ($228,000) for its failure to implement adequate security controls to protect customers’ information and prevent internal users from stealing this information for financial gain.

Strategies to Prevent Insider Threats

Organizations can resist insider threats and reduce cyber exposure by following proven security best practices. These include:

Implement Two-Factor Authentication (2FA)

2FA uses two different authentication factors when verifying a user’s identity before granting access to an enterprise system or application. This additional factor could be a code sent via text message, a fingerprint scan, or a security token.

Adding another factor to the authentication process makes it significantly harder for insider criminals to gain unauthorized access to your systems, even if they somehow manage to steal the username and passwords.

Implement Device IDs

When you implement device IDs, your employees can only use those programs that have been verified as being secure before gaining access to certain information or performing certain actions. Hacking into this type of system can be quite complex, which minimizes the possibility of insider attacks.

It’s also essential to perform regular audits for shadow IT to ensure that users are not using applications or devices that are not expressly approved by the IT team. In addition, implementing a least privilege access model limits access and prevents users from accessing or compromising resources and data.

Keep an Eye on All Red Flags

Earlier we saw how victim companies failed to identify suspicious activity that ultimately led to breaches and attacks. You can, however, detect such red flags by deploying employee monitoring software, user behavior analytics (UBA), and security information and event management (SIEM) systems.

These tools detect many insider threat indicators that may devolve into a full-blown attack, such as:

• Employees consistently working outside scheduled work hours
• Remote employees logging in from different locations or devices
• Users sending large amounts of sensitive information to removable drives, the cloud, or personal accounts
• Current or ex-employees complaining about the organization on social media
• Insiders grappling with personal problems such as gambling debts or alcohol addiction
• Insiders who deliberately bypass IT security controls, such as by using another employee’s password or tailgating into the office instead of using their own ID card
• Frequent displays of anger or frustration

Train Employees on Security Awareness

Employee cybersecurity training can increase the level of awareness within the organization. It discourages malicious insiders and makes negligent insiders think twice about their cyber hygiene knowledge and practices. This awareness program should teach them:

• How to detect and avoid phishing and ransomware attacks
• How social engineering works
• How to create strong passwords
• Why they should not share passwords or use unsecure Wi-Fi networks
• How to secure their remote devices
• Email communication best practices
• Why shadow IT applications are forbidden

In addition to the above strategies, you should also consider these best practices to prevent and mitigate insider threats:

• Install strong security protections such as firewalls, heuristic-based antivirus software, endpoint detection and response (EDR) tools, and data loss prevention (DLP) tools.
• Encrypt all enterprise data and devices.
• Perform regular backups.
• Regularly audit user access rights and permissions.
• Continuously monitor your IT ecosystem to detect suspicious activities.

Protect Your Organization from Insider Threats with Reciprocity ZenGRC

For most organizations, internal cybersecurity threats will be a constant challenge. You can minimize the potentially catastrophic impact of these threats with ZenGRC.

Reciprocity ZenGRC is intuitive and simple to use. It streamlines evidence management, workflows, continuous monitoring, and reporting for risk management.

Security policies, incident response procedures, and internal controls must be documented and updated regularly to assure that they meet the evolving cybersecurity environment. With Reciprocity ZenGRC’s document repository, policies and procedures are revision-controlled and easy to find.

Workflow management features offer easy tracking, automated reminders, and audit trails. The ZenConnect feature enables integration with popular tools such as Jira, ServiceNow, and Slack, assuring seamless adoption within your enterprise.

Insightful reporting and dashboards provide real-time visibility to gaps and high-risk areas. By better understanding your risk landscape, you can take action to protect your business from cyber attacks, avoid costly data breaches, and monitor the security posture of your vendors.

Strengthen your cybersecurity posture by leveraging Reciprocity ZenGRC single source of truth to highlight critical vulnerabilities and potential insider threats affecting your organization.

Schedule a demo to see how Reciprocity ZenGRC can continuously and effectively protect your organization from insider threats.