Here's the reality: many, if not most, security breaches involve internal users in some way. This risk is known as the insider threat. Creating a culture of cybersecurity with and for your employees is paramount in helping to safeguard your company against insider threats.

It's a well-known fact that cyberspace cannot be secured without the help of all users.

We spoke with Greg Cullison, who was at the time the Senior Executive of Security, Suitability & Insider Threat programs at Big Sky Associates. We discuss how creating a culture of cybersecurity at work helps organizations tackle their weakest link: employees.

“In our industry, insider threat is essentially any threat that relates to information on the network, and it could be either a malicious act or due to just plain negligence. Insider threats can follow three channels. The most common is the employee who has legitimate access to the system and data as part of their job. Then there is the outside worker who is temporarily contracted to do a job within the company. And finally, there is the "outside insider" who gains access to the network through the acquisition of passwords or a lost device such as a laptop or USB stick.”

“If you look at it from a data perspective, every organization has some type of data that makes it unique — this could be a customer list or a business strategy — anything that has economic value or is a financial driver. So no organization is immune from insider threat.”

“Training is as important as is having the right security software in place. However, there should be a collective responsibility in protecting company information. This is where we bring in process improvement. Our strength is in process improvement projects where we look at what has been missed. By uniting processes and merging functions you can address issues more effectively. For example with IT and HR working together, you can have a policy in place to monitor an employee who might have been flagged as having grievances or performance issues.”

“Organizations should get all the right stakeholders in one room to really understand what they are trying to achieve in terms of security and from there create a robust insider threat program that is part of the business process.”

“Training is a staple in every organization. But often after employees go through security training, they sign a form and the task is done. This is not enough — companies should follow up on training because here is where the danger lies if there are no reminders. Organizations have to understand what they need to achieve and then set policies in place to meet these objectives.”

“Repeated training can be quite boring and attendance is in no way a measurement of effectiveness. So training needs to be part of the overall process improvement so we recommend exercises with employees where someone poses as an insider and does activities to really test out your system.”