The danger of unintentional insiders

Imagine an employee who, maybe in a rush or due to a lack of proper training, clicks on a harmful link or shares sensitive information through an unsecured channel. Such simple mistakes can open the door for hackers to access private data, launch malware, or even take control of the entire system. 

What is an unintentional insider threat? 

“Unintentional Insider Threats: A Foundational Study” defines it as, “An unintentional insider threat is a current or former employee, contractor, or business partner who has or had authorized access to an organization’s network, system, or data and who, through action or inaction without malicious intent,  causes harm or substantially increases the probability of future serious harm to the confidentiality, integrity, or availability of the organization’s information or information systems.”

It could be a nurse, doctor, or administrative staff who unknowingly engages in actions that compromise security. These individuals typically just go about their daily tasks but might lack awareness about cybersecurity practices or fail to recognize the potential dangers of their actions.

These threats manifest in healthcare through various common, everyday actions. For example, an employee might accidentally leave a laptop containing patient data in a public place, or they might send sensitive information to the wrong email address. Other times, it could be something as simple as falling for a phishing scam or clicking on a malicious link that installs malware on the system. Due to the fact that healthcare employees often juggle multiple tasks and might not be fully trained in cybersecurity, they can easily make these mistakes.

Best practices

Prevention strategies

• Provide regular, engaging cybersecurity training that includes realistic scenarios specific to various roles within the organization.
• Use real-life breach examples to bring to attention the potential consequences and drive home the need for vigilance.
• Restrict access to sensitive information strictly to employees who need it to perform their job duties.
• Regularly review and adjust these permissions to keep them appropriate as job functions change.
• Use data loss prevention (DLP) software to monitor and block unauthorized attempts to access or share sensitive data.
• Standardize encryption for data at rest and in transit to protect it from unauthorized access.
• Promote an organizational culture where security is everyone’s responsibility.
• Encourage employees to report suspicious activities or mistakes without fear of reprisal, and reward proactive security behaviors.
  
  

Mitigation strategies

• Conduct thorough security audits and compliance reviews regularly to identify vulnerabilities before they can be exploited.
• Perform simulated phishing attacks to assess staff susceptibility and tailor training to address discovered weaknesses.
• Develop a detailed incident response plan outlining specific actions to take in the event of a data breach, including containment, communication, and remediation steps.
• Train all staff on their roles in the plan to ensure a coordinated and efficient response to incidents.
• Maintain all systems and software with the latest security patches and updates.

See also: HIPAA Compliant Email: The Definitive Guide

FAQs

What are insider threats?

Insider threats are security risks that come from within an organization, involving employees or contractors who misuse access to harm the organization, either intentionally or accidentally.

What is a data breach?

A data breach occurs when sensitive, protected, or confidential data is accessed, disclosed, or stolen without authorization.

What are HIPAA’s breach notification requirements?

HIPAA's breach notification requirements mandate that healthcare providers, insurers, and their business associates must notify affected individuals, the Department of Health and Human Services, and sometimes the media, within 60 days of discovering a data breach involving protected health information.