Sample Masters Corruption Report

Here is a sample that showcases why we are one of the world’s leading academic writing firms. This assignment was created by one of our expert academic writers and demonstrated the highest academic quality. Place your order today to achieve academic greatness.

Case Study Analysis of Insider Threat

Executive Summary

This report aims to analyse the insider threat to the Inscriber Ltd. that occur due to taking a bribe for providing organisational information to others. To attain the purpose of this report, it has found the potential causes by evaluating real-life cases of the companies and providing recommendations to overcome these issues.

The analysis of the report revealed that breach of customer information becomes the more profitable business in the global market. This report identifies the reason for increasing theft to the business as misconduct and inappropriate pay structure that made the individual inclined towards unethical activities.

The report identified that there are different types of internal threats, from employees that have malicious purposes; even those who are just trying to do their job are careless or distracted. The reason for this activity is created by competitors that offer an irrecusably amount of money, and they will already have a spy inside the company to gain access to sensitive data such as new product launches and marketing campaigns.

To prevent the company from this threat, the audit committee is considered a powerful weapon at the disposal of organisations to effectively combat corruption. The causes and not just the consequences of acts of corruption must be tackled. There is a myriad of audit techniques for detecting signs of corruption that are applied in Inscriber Ltd.

In the fight against corruption, the participation of all is fundamental. Reducing corruption is not an easy task it requires continuous efforts to do monitoring and identify employees’ behaviour. To reduce the impact of insider threats recommendation for the company has been made.

Introduction

The purpose of this report is to evaluate the insider threat to the Inscriber Ltd. in which the call centre agents have taken a bribe from others to provide the customer’s personal information to others. In response to this, the report will identify the key potential causes by evaluating real-life cases of the companies, and provide recommendations to overcome these issues. This report identifies the underlying reason for the occurrence of insider threats. Moreover, the strategy recommendation has been made to avoid further internal threats to the company.

Overview

Insider threats are associated with people who have access to confidential information or an organisation’s private platforms, such as employees, former employees, business partners, or service providers. Any individual who, at any time in the present or past, has had access to private information and systems may represent a potential vulnerability (Wang, Gupta, & Rao, 2015).

However, not all risks related to people are promoted premeditatedly or are the result of fraud or industrial spying. Often, unsafe habits or lack of information about good safety practices can cause a significant number of gaps. A user can enter an email address incorrectly when forwarding sensitive information; click links or open files in spear-phishing emails; there are still cases of browsing suspicious websites that force the download of unwanted applications, such as spyware, or that promote crypto-mobile mining.

Case Analysis

Growing Customer Identity Theft:

According to a survey report, a more profitable market than the global illicit drug trade is that of identity theft. The IT security company released a study in which it says that those responsible for increasing these thefts are the users themselves. In large organisations, user misconduct accounted for 35% of incidents during the reporting period, compared to 12% in the same period last year.

Digital transformation requires new care from digitalization that became a path for increasing efficiency. The security of the information happened to require an unprecedented level of performance. When talking about Digital Transformation, Zargar, Nowroozi, and Jalili, (2016) indicated that the presence of technologies such as Cloud Computing, Mobility, Big Data, IoT and social networks in the relationship between companies and their clients are generating an urgent need to redefine commercial and operational processes.

Similarly, BBC (2007) reported that the data of around 15,000 customers were at the risk of fraud when a customer data disk was lost by a courier that contain the personal information of customers.

According to the organisation, victims around the world lose about 290 billion dollars per year due to this type of cybercrime. In the first quarter of 2018, users increased their visits to malicious websites or installed and executed questionable software or were still lured by e-mails and attachments from unknown senders through a phishing attack (Liu et al., 2018).

If data breaches represent a high risk to affected persons, then Inscriber Ltd. should inform their customers, unless there are effective technical and organisational protective measures or other measures to ensure that the risk is not likely to be realized again. The insider attackers have some common traits as reported by CPNI that include immaturity, low self-esteem, lack of ethics, higher fantasize, lack of conscientiousness and instability (Upton, and Creese, 2014).

It is common to have different cases of a data breach by employees such as a hospital worker who decides to copy patient data to a CD and publish it online. The hospital finds out what happened a few days later. As soon as the hospital becomes aware of what happened, it has 72 hours to inform the supervisory authority since the personal data in question contain sensitive information (Suh, & Yim, 2016).

In this case, there is doubt as to whether the hospital has implemented adequate technical and organisational protection measures or not. Similarly, data of the employee are stolen by an organisation that includes their personal information such as addresses, household composition, monthly salary and claims for reimbursement of medical expenses of all workers. Moreover, the leading organisation has reported cases of a data breach such as last year; Yahoo! revealed that more than one billion personal accounts were hacked from their servers (Trautman & Ormerod, 2016).

Internal Threats to the business:

There are different types of internal threats, from employees who have malicious purposes; even those who are just trying to do their job are careless or distracted. Many data breaches currently originate from internal threats or from employees who have had their credentials stolen (Elhai et al., 2017).

Hence, the idea that such threats are only those employees with bad intentions who are looking for valuable information to sell to competitors or leaking to the press needs to be ended. There are different types of internal threats, from employees who have malicious purposes, even those who are just trying to do their job.

Management of insider threats is essential for the management to ensure the quality of services and protecting the organization. However, the organization is unable to anticipate any risk due to the implementation of technology that changes the environment that affects the organization involved (Upton, and Creese, 2014).

To address this type of threat, companies need to look at the source of the problem to understand who these employees are and why they pose a risk to the business. Imagine that an employee who is responsible for critical processes in the company, such as the IT infrastructure, for example, begins to feel devalued and therefore unhappy with their job (Janakiraman, Lim, & Rishika, 2018).

Another case of data theft was reported by BBC (2013) in which the policewomen were involved to gain access to information. This activity was supported by two men who confessed their role in these activities. The case was filed against two drug dealers and the evidence was formed from the key element of the prosecution.

By feeling frustrated, employees may begin to sabotage business operations on purpose. To identify this type of employee, the information security team needs to be aware of some common signs of dissatisfaction. Employees unhappy with their salary are a problem in every business.

For a dubious competitor to win them, all manager has to do is offer an irrecusably amount of money, and they will already have a spy inside the company to gain access to sensitive data such as new product launches and marketing campaigns. According to Martin, Borah, & Palmatier (2017), corporate espionage is not easy to spot, especially since the primary purpose of a spy is to be off the radar.

To uncover this kind of behaviour, companies need advanced controls for monitoring data and endpoints. The CPNI study the multiple cases of insider threats that recognize the main activities which include five common activities such as facilitating third party access to assets, process corruption, facilitating third party access and IT disruption. The commonly applied technique by insiders includes process corruption and disclosure of sensitive information to third parties (CPNI, 2013).

How to reduce Internal Threat to the Business:

Attacks on corporations do not come only through the internet. Insiders put privileged data at risk and are often driven by intentional actions. If the growing number of external attacks that IT professionals have to deal with is not enough, threats are also being observed incorporating internal environments.

Thus, adding security measures to the networks, capable of reducing cyber-attacks, are no longer sufficient. One must also be attentive to employees, especially those who have access to inside information, known as insiders. A recent study, produced by the CSO in conjunction with the US Secret Service, showed that 29 per cent of insider attacks resulted in more damage than malicious hacker damage.

The report also revealed that 47% of the incidents originating from the company itself were triggered by innocent employees, who eventually fell into data theft techniques such as phishing (Thompson, Ravindran, & Nicosia, 2015).

If it were only the innocence of the origin of these threats, it would require only obvious actions to resolve this type of occurrence, simply by continuing training and insistence on compliance with a Security Policy. However, there are also malicious insiders. That is employees with access to privileged information.

Another survey, conducted by Yen, Lim, Wang, and Hsu, (2018), pointed out the main objectives of these bad employees who were caught. 62% of them were looking for a second source of income, conveying privileged data to competitors and the black market, while 29% admitted to stealing information for future use, whether in other jobs in the same segment or even in personal initiatives, as new companies and 9% assumed that they just wanted to sabotage the companies.

The immediate response of the Supervisor:

The supervisory authority only has to be notified of a breach of personal data if that breach presents risks to the rights and freedoms of individuals. In particular, to cause detrimental effects such as discrimination, reputation threat, financial loss, loss of confidentiality or any other significant social or economic disadvantage.

This process has to be dealt with varies among different cases. As an example, the supervisory entity will have to be notified about the loss of customer data when that loss places individuals at risk of identity theft (Haislip, Lim & Pinsker, 2017). Where the violation results in a high risk for the rights and freedoms of individuals, they will also have to be notified directly.

In this regard, a personal data breach has to be reported to the supervisory body within 72 hours after the organisation knows of it. However, the RGPD allows this communication to be made in phases taking into account that it will most likely be impossible to investigate a data breach within this time frame (Thompson, Ravindran & Nicosia, 2015).

If the breach of data is sufficiently serious to ensure its public disclosure, Inscriber Ltd., has to the action without any delay. Failure to comply with these procedures means the application of fines is delayed. A login, for example, from a country where the company has no other unit can be considered a suspect.

One of the newest techniques for identity theft is a denial of distributed services using misconfigured servers to perform amplification attacks. Therefore, it is critical to verify that users are not contributing to creating the arsenals for the servers that can be used in attacks (Haislip, Lim & Pinsker, 2017).

Ideally, the user himself or herself should be aware of the data that forms their identity and how much they are of interest to hackers. Companies must provide full support so that this information is not stolen by corporate networks, preventing attacks by the company’s computers.

Protecting Employee Identity:

It is important for the employee to be fully aware of which of their data is open to being hacked by cybercriminals. Do a full name search on top search sites as well as enter phone numbers and documents, and business and home addresses to do an investigation into what a malicious person can easily find on the internet.

Each employee should then receive training on how his/her routine browsing can impact the business of the company in which he/she works, even unconsciously; open attachments from unknown senders, click on malicious links and other phishing possibilities (Trautman, & Ormerod, 2016).

The IT staff should follow the normal behaviour of each user, knowing the most common login and logout times, locations and devices that he uses to connect to the system, and in case of any deviations from those standards, send an alert to security personnel.

Audit as an Anti-Corruption Tool:

The audit constitutes a powerful weapon at the disposal of organisations to effectively combat corruption. The causes and not just the consequences of acts of corruption must be tackled. There is a myriad of audit techniques for detecting signs of corruption that are applied in Inscriber Ltd. In the fight against corruption, the participation of all is fundamental.

Reducing corruption is not an easy task; it will be up to each citizen to examine conscience to identify everyday situations that could be corrupted including attempted bribery in road blitz, and acquisition of pirated products within the company (Thompson, Ravindran, & Nicosia, 2015).

It is necessary to cut this risk to the business because every policy is a mirror of the company’s employees. To deal with this situation, Inscriber Ltd. management decides to involve auditing practices to ensure data security and protect business information. As a way to protect investors, several requirements are put on companies in this market. One is the choice of independent auditing.

A company hired by a company interested in opening capital should enjoy the freedom to scrutinize accounting and business practices (Yen, Lim, Wang, & Hsu, 2018). With this information that individuals, pension funds and even other companies define their investments, being able to evaluate if the company is indebted, offers environmental risks that could generate protection.

This is used for recapitalizing the business and consequently, devalues business actions. Haislip, Lim, and Pinsker (2017) indicated that without this information investors would not be able to measure the risk to which they are exposing their money.

From the available tools to minimize the risks of corruption in an organisation, the audit stands out from the others. With the advent of the Digital Public Bookkeeping System, institutions will have the best electronic audit software capable of crossing data for monitoring and prevention of fraud in real-time, and the on-site visit of the auditor is not necessary at the company’s headquarters.

Inscriber has applied this to make it clearer identification of the business improved process of control that has provided, improved control over the process, faster access to information and more effective monitoring of cross-data operations (Suh & Yim, 2016). Therefore, it is the Virtual Audit that has transformed the business practices. The audit is facing new times: the virtual is already real, for inspection purposes.

Recommendation

58% of security incidents are caused by human errors, while only 42% are caused by technology failures. According to a recent study conducted by the Expert Security Company UK, almost one in five people have already been affected by workplace crime. This shows that internal threats must be given more and more attention by companies around the world. Here are some ways to make sure business is not vulnerable to such threats:

Establish security policies:

Companies need to ensure that data access is monitored in real-time. It is common to underestimate the impact that internal threats have on the corporate environment, but especially for privileged accounts, employees can have access not only to sensitive data but also to control the entire IT infrastructure. In this aspect, it is recommended to the company to prevent internal threats by beginning monitoring how their data is being used.

Organisations that do not have this kind of control of user access are unlikely to be able to identify when they are misbehaving and block their actions. Over the past year, it has been found that each employee has access to 82% of the total 6.1 million folders incorporating systems (Wang, Gupta & Rao, 2015). About 28% of folders have universal access within companies – that is, everyone can access them without any kind of control over identity or activities within the files.

Introduce robust security policies:

More and more companies are now allowing their employees to use their own devices to work. The trend known as Bring Your Device (BYOD) requires companies to tailor their security strategy to this new reality. It is essential to introduce clear BYOD policies that specify what is allowed and what is not, as well as offer appropriate training to the end-user. Imagine, for example, that the HR director clicks on a phishing e-mail and suddenly a hacker has access to all of the HR data.

This will be a major problem for the entire company, which may suffer from the leakage of personal data from employees and face several financial and reputational damages (Suh & Yim, 2016). Therefore, it is important to make sure everyone understands the dangers of data security and knows the right way to take advantage of BYOD to increase productivity while preventing internal threats.

Adequate training:

Providing the education necessary for the end-user to understand what is expected from him in terms of security will help ensure the protection of the entire business. Therefore, it is important to communicate with the team, always with transparency, to maintain control before the situation leaves the hands of the managers.

By offering training with a few individual sessions, for example, it will be possible to get to know employees better and build strong and lasting relationships, where individuals are encouraged to always strive for a balance between productivity and safety. Companies must create a culture that encourages employees to intelligently use corporate resources and stay away from illegal activities.

Conclusion

Based on the above discussion of customer data theft by internal employees, it has been concluded that insider threats are associated with people who have access to confidential information or an organisation’s private platforms that affect the business’s private information. It has been identified that this type of behaviour in the organisation can be controlled with the implementation of strict monitoring and endpoints.

Moreover, it is conclusive to state that business management must be attentive to employees, especially those who have access to inside information. It has been found that attacks on corporations do not come only through the internet. Employees put privileged data at risk and are often driven by intentional actions.

References

BBC, 2007. Data lost by Revenue and Customs [Online] Available at: http://news.bbc.co.uk/2/hi/uk/7103911.stm [Accessed on 14th Jan, 2019]

BBC, 2013. Hampshire policewoman Rebecca Swanston jailed for corruption [Online] available at: https://www.bbc.com/news/uk-england-hampshire-23548877 [Accessed on 14th Jan, 2019]

CPNI, 2013. CPNI INSIDER DATA COLLECTION STUDY [Online] available at: https://www.cpni.gov.uk/system/files/documents/63/29/insider-data-collection-study-report-of-main-findings.pdf [Accessed on 14th Jan, 2019]

Eberz, S., Rasmussen, K., Lenders, V., & Martinovic, I. (2015). Preventing lunchtime attacks: Fighting insider threats with eye movement biometrics.

Elhai, J. D., Chai, S., Amialchuk, A., & Hall, B. J. (2017). Cross-cultural and gender associations with anxiety about electronic data hacking. Computers in Human Behavior, 70, 161-167.

Haislip, J., Lim, J. H., & Pinsker, R. (2017). Do the Roles of the CEO and CFO Differ when it comes to Data Security Breaches?.

Janakiraman, R., Lim, J. H., & Rishika, R. (2018). The Effect of a Data Breach Announcement on Customer Behavior: Evidence from a Multichannel Retailer. Journal of Marketing, 82(2), 85-105.

Kammüller, F., & Probst, C. W. (2017). Modeling and verification of insider threats using logical analysis. IEEE systems journal, 11(2), 534-545.

Liu, L., De Vel, O., Han, Q. L., Zhang, J., & Xiang, Y. (2018). Detecting and Preventing Cyber Insider Threats: A Survey. IEEE Communications Surveys & Tutorials, 20(2), 1397-1417.

Martin, K. D., Borah, A., & Palmatier, R. W. (2017). Data privacy: Effects on customer and firm performance. Journal of Marketing, 81(1), 36-58.

Suh, Y. A., & Yim, M. S. (2016). A Feasibility Study on Detection of Insider Threats based on Human Bio-signals.

Thompson, N., Ravindran, R., & Nicosia, S. (2015). Government data does not mean data governance: Lessons learned from a public sector application audit. Government information quarterly, 32(3), 316-322.

Trautman, L. J., & Ormerod, P. C. (2016). Corporate Directors’ and Officers’ Cybersecurity Standard of Care: The Yahoo Data Breach. Am. UL Rev., 66, 1231.

Upton, D. M., and Creese, S., 2014. The Biggest Cybersecurity Threats Are Inside Your Company. RISK MANAGEMENT, The Danger from Within [Online] available at: https://hbr.org/2014/09/the-danger-from-within [Accessed on 14th Jan, 2019]

Wang, J., Gupta, M., & Rao, H. R. (2015). Insider threats in a financial institution: Analysis of attack-proneness of information systems applications. MIS quarterly, 39(1).

Yen, J. C., Lim, J. H., Wang, T., & Hsu, C. (2018). The impact of audit firms’ characteristics on audit fees following information security breaches. Journal of Accounting and Public Policy, 37(6), 489-507.

Zargar, A., Nowroozi, A., & Jalili, R. (2016, September). XABA: A zero-knowledge anomaly-based behavioral analysis method to detect insider threats. In Information Security and Cryptology (ISCISC), 2016 13th International Iranian Society of Cryptology Conference on (pp. 26-31). IEEE.

Frequently Asked Questions