While cybersecurity policies, procedures, and solutions are often focused on cybercriminals outside of the organization, more and more often, it’s people inside the organization who are responsible for data breaches.
In fact, there’s been a 47% increase in incidents over the last two years; this includes accidental data loss and deliberate data exfiltration by negligent or disgruntled employees or contractors. This poses an enormous issue for the nonprofit industry considering the global average cost of an insider threat is a whopping $11.45 million.
Understanding different motives and methods of exfiltration are key for detection and prevention. A “Malicious Insider” is when someone knowingly and intentionally steals data. For example, an employee using valuable information, like Personally Identifiable Information (PII), or a donor’s financial information, for personal gain. The incentive behind this type of breach can vary from a financial incentive, like selling private data on the dark web, or gaining a competitive edge by taking donor records to a new fundraising job.
The “Negligent (or Unaware) Insider” is just your “average” employees doing their jobs. Unfortunately, to err is human, which means people can - and do - make mistakes. While there are a number of ways employees can mishandle data, the common thread is that data leaks are unintentional. By sending a misdirected email, falling victim to a phishing or spear-phishing attack, or even losing their work device, donor data is at risk due to nothing more than a simple mistake by an employee.
While nonprofit leaders are certainly aware of the risks around insider threats, preventing breaches caused by malicious or careless employees is a challenge. To detect and prevent threats, organizations must maintain full visibility over data - both digital and physical - including who has access to it. But, if an individual has legitimate access to a system or network, how can IT or security teams know if and when they’re exfiltrating data?
While there are a number of ways in which malicious or careless employees can exfiltrate (or otherwise lose) data, email is no doubt the number one threat vector. Billions of emails are sent every day and many of these emails contain highly sensitive information including donor data, financial records, and intellectual property. That means that in order to have a chance at detecting and preventing insider threats, organizations must look at securing email communications. But, traditional Data Loss Prevention solutions for email fall short and today, machine learning technology is the only way to prevent data loss and data exfiltration.
Gravyty’s artificial intelligence (AI) turns an organization’s email data into its best defense against inbound and outbound email security threats. Powered by AI, our Human Layer Security solution understands human behaviors unique to the nonprofit fundraising space, enabling it to automatically detect and prevent anomalous and dangerous activity like data exfiltration attempts and misdirected emails.