Today, Tessian released The State of Data Loss Prevention 2020, a comprehensive report that explores new and perennial challenges around data loss prevention.

Our findings reveal that data loss on email is a bigger problem than most realize, that remote-working brings new challenges around DLP, and that the solutions currently deemed most effective may actually be the least. Why does this report matter? IT, security, and compliance readers have a lot to gain by reading this report. To really understand why, we have to look at the current landscape. Insider threats are a growing problem While email threats from external bad actors (like spear phishing and business email compromise) dominate headlines, email threats from insiders are steadily rising. In fact, there’s been a 47% increase in incidents over the last two years. This includes accidental data loss and deliberate data exfiltration. According to Verizon’s 2020 Data Breach Investigations Report “It is a bit disturbing when you realize that your employees’ mistakes account for roughly the same number of breaches as external parties who are actively attacking you.” The DLP market is booming and is on track for significant growth. Why? Because it’s one of the top spending priorities for IT leaders with 21% planning to acquire DLP tools within the next year.  Remote-working makes DLP even more challenging Over the last eight weeks, workforces around the world have transitioned from office-to-home. That means the perimeter has disappeared and past strategies have become obsolete. COVID-19 has been deemed a “field day for Insider Threats”. There are more opportunities than ever for employees to exploit privileged access to data, working from home can reduce the vigilance of employees handling confidential data, and there’s been a marked increase in COVID-19 phishing attacks. While some organizations will encourage their employees to migrate back to offices, many (including Facebook) have already opted to maintain remote-working set-ups.  Interested in learning more about the methods and motives of Insider Threats? Read our blog: What is an Insider Threat? Insider Threat Definitions, Examples, and Solutions. The implications of a data breach are far-reaching  The consequences of a data breach aren’t limited to lost data and revenue loss. Organizations also experience a 2-7% churn rate after a breach. Data privacy regulations add insult to injury. In the first quarter of 2020 alone, GDPR fines totaled nearly €50 million. But, we had to look beyond third-party research and conduct our own.  What will I learn? We analyzed Tessian platform data and commissioned OnePoll to survey 2,000 professionals (1,000 in the US and 1,000 in the UK) and 250 Information Technology (IT) leaders. We also interviewed IT, security, and compliance leaders about their own experiences with DLP. Here’s what we found out: !function(e,t,s,i){var n="InfogramEmbeds",o=e.getElementsByTagName("script"),d=o[0],r=/^http:/.test(e.location)?"http:":"https:";if(/^\/{2}/.test(i)&&(i=r+i),window[n]&&window[n].initialized)window[n].process&&window[n].process();else if(!e.getElementById(s)){var a=e.createElement("script");a.async=1,a.id=s,a.src=i,d.parentNode.insertBefore(a,d)}}(document,0,"infogram-async","//e.infogram.com/js/dist/embed-loader-min.js");

Data loss incidents are happening as much as 38x more often than IT leaders currently estimate. 800 misdirected emails are sent every year in organizations with 1,000 employees. 27,500 emails containing company data are sent to personal accounts every year in organizations with 1,000 employees. 84% of IT leaders say DLP is more challenging when their workforce is working remotely. !function(e,t,s,i){var n="InfogramEmbeds",o=e.getElementsByTagName("script"),d=o[0],r=/^http:/.test(e.location)?"http:":"https:";if(/^\/{2}/.test(i)&&(i=r+i),window[n]&&window[n].initialized)window[n].process&&window[n].process();else if(!e.getElementById(s)){var a=e.createElement("script");a.async=1,a.id=s,a.src=i,d.parentNode.insertBefore(a,d)}}(document,0,"infogram-async","//e.infogram.com/js/dist/embed-loader-min.js");

While 91% of IT leaders say they trust their employees to follow security policies while working from home, almost half (48%) of employees say they’re less likely to follow safe data practices when working from home. Email is the threat vector IT leaders are most concerned about. 54% of employees say they’ll find a workaround if security software or policies prevent them from doing their job and 51% say security tools and software impede their productivity.  While IT leaders believe security awareness training is the most effective way to prevent data loss, machine learning is the better option.  Dozens more insights in the full report, including segmented data around industry, company size, age, and region.  How can I access The State of Data Loss Prevention 2020? IT leaders must have visibility over how their employees are handing and mishandling data on email in order to implement effective DLP strategies.  Our report shines a light on the problems and best solutions.  You can access the full report via our microsite. And, if you’re interested in learning more, save your spot at Tessian Human Layer Security Summit on June 18.

Insider threats are a big problem for organizations across industries, especially now with mass layoffs and new remote-working arrangements. Why? Because they’re so hard to detect. After all, insiders have legitimate access to systems and data, unlike the external bad actors many security policies and tools help defend against. It could be anyone, from a careless employee to a rogue business partner. That’s why we’ve put together this list of Insider Threat types and examples. By exploring different methods and motives, security, compliance, and IT leaders (and their employees) will be better equipped to spot Insider Threats before a data breach happens. Types of Insider Threats First things first, let’s define what exactly an Insider Threats is. Insider threats are people – whether employees, former employees, contractors, business partners, or vendors – with legitimate access to an organization’s networks and systems who deliberately exfiltrate data for personal gain or accidentally leak sensitive information. The key here is that there are two distinct types of Insider Threats:  The Malicious Insider  The Negligent Insider The Malicious Insider Malicious Insiders knowingly and intentionally steal data.  For example, an employee or contractor may exfiltrate valuable information (like Intellectual Property (IP), Personally Identifiable Information (PII), or financial information) for some kind of financial incentive, a competitive edge, or simply because they’re holding a grudge for being let go or furloughed.  Financial Incentives According to Verizon’s 2020 Data Breach Investigations Report, 86% of breaches are financially motivated. Whether it’s a list of customer email addresses or trade secrets, the Dark Web has helped monetize data and now, it’s easier than ever to sell information.  Click here to jump to the real-world example. Competitive Edge According to Tessian research, 45% of employees download, save, send, or otherwise exfiltrate work-related documents before leaving a job or after being dismissed. While they could simply be adding a project to their portfolio, they could also be hoping to impress or bribe a new or potential employer with trade secrets or customer information.  Click here to jump to the real-world example. A Grudge  Emotions can run high when it comes to someone’s livelihood. That’s one reason why some Insider Threats act out of revenge. In fact, according to one report, almost 10% of Insiders are motivated by a grudge. Click here to jump to the real-world example. The Negligent Insiders  Negligent insiders are just your average employees who have made a mistake.  For example, an employee could send an email containing sensitive information to the wrong person, email company data to personal accounts to do some work over the weekend, fall victim to a phishing or spear phishing attack, or lose their work device.  Sending an email to the wrong person Data emailed to the incorrect recipient is the second most reported cause of data breaches. At Tessian, we call this is a misdirected email and it’s happening almost twice as much as IT leaders currently estimate.  While it’s unintentional, the consequences can be tremendous, especially for those organizations that are bound to compliance standards or data privacy regulations. Think about it: emails contain structured and unstructured data in either the body copy, as attachments, or both. In certain industries – like Healthcare and Financial Services – the likelihood of email communications containing sensitive information is even greater.  Click here to jump to the real-world example. Sending work emails “home” According to Tessian platform data, 27,500 emails are sent to personal accounts every year in organizations with 1,000 people. We call these unauthorized emails. While – yes – this could be done maliciously to exfiltrate data, the majority of employees are just trying to do their jobs. Nonetheless, sending company data to personal email accounts is often against security policies. You can read more about why that is on this blog: The Dark Side of Sending Work Emails “Home”. Click here to jump to the real-world example. Falling victim to a phishing or spear phishing attack Phishing and other social engineering attacks are designed for one of three reasons: to extract sensitive information or credentials, to install malware onto a network, or to initiate a wire transfer. If the attack is successful – meaning the target (an employee) falls for the scam – there could be serious consequences.  Click here to jump to the real-world example. Losing your work device(s)   Whether it’s a mobile phone, laptop, or tablet, losing a work device could lead to a data breach, especially if the device is left unlocked.  Misconfiguration It’s important to remember that employees aren’t just responsible for data, they’re also responsible for the architecture that supports that data. Whether it’s configuring a firewall or setting up access settings for Cloud Storage, one simple mistake could lead to a breach.  Worryingly, these incidents are on the rise. From 2018-2019, incidents involving misconfiguration have more than doubled. Click here to jump to the real-world example.

7 Examples of Insider Threats  Example #1: The employee who exfiltrated data after being fired or furloughed Since the outbreak of COVID-19, 81% of the global workforce have had their workplace fully or partially closed. And, with the economy grinding to a halt, employees across industries have been laid off or furloughed.  This has caused widespread distress. When you combine this distress with the reduced visibility of IT and security teams while their teams work from home, you’re bound to see more incidents of Malicious Insiders.  One such case involves a former employee of a medical device packaging company who was let go in early March 2020  By the end of March – and after he was given his final paycheck – Dobbins hacked into the company’s computer network, granted himself administrator access, and then edited and deleted nearly 120,000 records.  This caused significant delays in the delivery of medical equipment to healthcare providers.

Example #2: The employee who sold company data for financial gain href=”https://www.telegraph.co.uk/technology/2018/09/28/bupa-fined-175000-employee-stole-500000-customer-records-tried/”>an employee at Bupa accessed customer information via an in-house customer relationship management system, copied the information, deleted it from the database, and then tried to sell it on the Dark Web.  The breach affected 547,000 customers and in 2018 after an investigation by the ICO, Bupa was fined £175,000.

Example #3: The employee who fell for a phishing attack While we’ve seen a spike in phishing and spear phishing attacks since the outbreak of COVID-19, these aren’t new threats. One example involves an email that was sent to a senior staff member at Australian National University. The result? 700 Megabytes of data were stolen. This data was related to both staff and students and included details like names, addresses, phone numbers, dates of birth, emergency contact numbers, tax file numbers, payroll information, bank account details, and student academic records.

Example #4: The employee who took company data to a new employer for a competitive edge This incident involves two of the biggest tech players: Google and Uber. In 2015, a lead engineer at Waymo, Google’s self-driving car project, left the company to start his own self-driving truck venture, Otto. But, before departing, he exfiltrated several trade secrets including diagrams and drawings related to simulations, radar technology, source code snippets, PDFs marked as confidential, and videos of test drives.  How? By downloading 14,000 files onto his laptop directly from Google servers. Otto was acquired by Uber after a few months, at which point Google executives discovered the breach. In the end, Waymo was awarded $245 million worth of Uber shares and, in March, the employee pleaded guilty.

Example #5: The employee who accidentally sent an email to the wrong person Misdirected emails happen more than most think. In fact, Tessian platform data shows that at least 800 misdirected emails are sent every year in organizations with 1,000 employees. But, what are the implications? It depends on what data has been exposed.  In one incident in mid-2019, the private details of 24 NHS employees were exposed after someone in the HR department accidentally sent an email to a team of senior executives. This included: Mental health information Surgery information While the employee apologized, the exposure of PII like this can lead to medical identity theft and even physical harm to the patients. This isn’t the only incident involving the NHS. (See below.)

Example #6: The employee who accidentally misconfigured access privileges Just last month, NHS coronavirus contact-tracing app details were leaked after documents hosted in Google Drive were left open for anyone with a link to view. Worse still, links to the documents were included in several others published by the NHS.  These documents – marked “SENSITIVE” and “OFFICIAL” contained information about the app’s future development roadmap and revealed that officials within the NHS and Department of Health and Social Care are worried about the app’s reliance and that it could be open to abuse that leads to public panic.

Example #7: The employee who sent company data to a personal email account We mentioned earlier that employees oftentimes email company data to themselves to work over the weekend.  But, in this incident, an employee at Boeing shared a spreadsheet with his wife in hopes that she could help solve formatting issues. The result? The personal information of 36,000 employees were exposed, including employee ID data, places of birth, and accounting department codes.

How common are Insider Threats? Incidents involving Insider Threats are on the rise, with a marked 47% increase over the last two years. This isn’t trivial, especially considering the global average cost of an Insider Threat is $11.45 million. This is up from $8.76 in 2018. Who’s more culpable, Negligent Insiders or Malicious Insiders?  Negligent Insiders (like those who send emails to the wrong person) are responsible for 62% of all incidents Negligent Insiders who have their credentials stolen (via a phishing attack or physical theft) are responsible for 25% of all incidents Malicious Insiders are responsible for 14% of all incidents It’s worth noting, though, that credential theft is the most detrimental to an organization’s bottom line, costing an average of $2.79 million.  Which industries suffer the most? The “what, who, and why” behind incidents involving Insider Threats vary greatly by industry.  For example, customer data is most likely to be compromised by an Insider in the Healthcare industry, while money is the most common target in the Finance and Insurance sector. But, who exfiltrated the data is just as important as what data was exfiltrated. The sectors most likely to experience incidents perpetrated by trusted business partners are: Finance and Insurance Federal Government Entertainment Information Technology Healthcare State and Local Government Overall, though, when it comes to employees misusing their access privileges, the Healthcare and Manufacturing industries experience the most incidents. On the other hand, the Public Sector suffers the most from lost or stolen assets and also ranks in the top three for miscellaneous errors (for example misdirected emails) alongside Healthcare and Finance. The bottom line: Insider Threats are a growling problem. We have a solution.

How does Tessian prevent Insider Threats? Tessian turns an organization’s email data into its best defense against inbound and outbound email security threats. Powered by machine learning, our Human Layer Security technology understands human behavior and relationships, enabling it to automatically detect and prevent anomalous and dangerous activity. Tessian Enforcer detects and prevents data exfiltration attempts Tessian Guardian detects and prevents misdirected emails Tessian Defender detects and prevents spear phishing attacks Importantly, Tessian’s technology automatically updates its understanding of human behavior and evolving relationships through continuous analysis and learning of the organization’s email network.  Curious how frequently these incidents are happening in your organization? Click here for a free threat report.

While there are various ways in which someone can exfiltrate data – which we’ve covered in What is Data Exfiltration? Tips for Preventing Data Exfiltration Attacks – email is the biggest risk. In fact, it’s the threat vector IT leaders are most concerned about protecting.  In this article we’ll answer three key questions: What is data exfiltration on email? Why is it so dangerous? How can organizations prevent it from happening?  What is data exfiltration on email? In order to understand what data exfiltration on email is, we should start with what data exfiltration is more broadly. Data exfiltration is the act of sensitive data deliberately being moved from inside an organization to outside an organization’s perimeter without permission. This can be done through the digital transfer of data, the theft of documents or servers, or via an automated process.  Data and sensitive information found in spreadsheets, calendars, trading algorithms, planning documents, and customer PII can be moved outside of an organization’s perimeter via email in one of two ways: Someone inside the organization (like an employee, exiting employee, contractor, or business partner) emailing data to their own personal accounts or to a third-party. External bad actors targeting employees with phishing or spear phishing scams. While these email attacks can be designed for the purpose of initiating a wire transfer, they’re often ploys to extract sensitive information or credentials or to install malware onto a network.

Why is data exfiltration on email so dangerous? We’ve already mentioned that email is the threat vector IT leaders are most concerned about protecting. But why? There are two key reasons: it’s easy to access (email accounts today are managed on laptops, smartphones, tablets, and even watches) and the underlying technology behind email hasn’t evolved since its inception in the 1970s. That means there are core security features missing that modern communication platforms have as a standard, including the ability to redact or recall and encryption-by-default.  This makes it one of the go-to mediums for data exfiltration. In fact, according to one report, 10% of all insiders and 10% of all external bad actors use email to steal data. And, if data is successfully exfiltrated, the consequences can be tremendous. = Case in point: A major US health insurance provider agreed to pay $115 million to settle a class-action lawsuit after it was discovered that an employee had stolen data on 18,000 Medicare members, including names, ID numbers, Social Security numbers, health plan IDs, and dates of enrollment.  Interested in learning more about incidents like this? Read 6 Examples of Data Exfiltration on our blog.  How can I prevent data exfiltration on email? Data exfiltration is a big problem for organizations.  Whether it’s an exiting employee emailing data to their personal accounts on their way out (which 45% of employees admit to doing) or a hacker targeting someone with privileged access to networks and data via a phishing email, security, IT, and compliance leaders must find a way to prevent sensitive information from leaving their organization.  there are several solutions available, but few succeed in preventing data exfiltration attempts on email. Blocking or blacklisting domains What it is: Data exfiltration prevention has often been simplified to stopping communication with certain accounts/domains (namely freemail accounts like @gmail). Why it doesn’t work: This is a blunt approach that impedes on employee productivity. There are many legitimate reasons to communicate with freemail accounts, such as updating private clients, managing freelancers, or emailing friends and family about non-work issues. What’s more, a determined insider could easily circumvent this by setting up an account with its own domain. Secure Email Gateways (SEGs) What it is: SEGs are essentially more sophisticated spam filters. They’re used to block malicious inbound email threats like phishing attacks. Why it doesn’t work: While SEGs may be effective in blocking bulk phishing emails, they can’t stop all spear phishing emails. That means the most targeted attacks can still get through and employees could easily fall victim to an attack and unknowingly exfiltrate data to a bad actor. (Not sure what the difference is between phishing and spear phishing? Read this.) Rule-Based solutions What it is: Organizations could implement rule-based solutions that take the form of “if-then” statements. These “if-then” statements involve keywords, email addresses, and regular expressions that look for signals of data exfiltration. For example, “If an email contains the word “social security number”, then quarantine the email and alert IT.” Why it doesn’t work: Rule-based solutions are impossible to maintain because data changes in value and sensitivity over time. Beyond that, you simply can’t define or predict human behavior with rules. That’s why 85% of IT leaders say rule-based DLP is admin-intensive and just 18% say it’s the most effective way to prevent data loss.  Training  What it is: Because it’s people who control our data, training is a logical solution to data exfiltration. In fact, 61% of organizations have training every 6 months or more frequently.  Why it doesn’t work: While training does help educate employees about data exfiltration and what the consequences are, it’s not a long-term solution and won’t stop the few bad eggs from doing it. You also can’t train away human error.  Machine Learning What it is: Machine learning (ML) models trained on historical email data understand the intricacies and fluctuations of human relationships over time. That means ML models can constantly update their “thinking” to determine whether an action looks like exfiltration or not.  Why it does work: This is the “human” way forward. At Tessian, we call it Human Layer Security. Machine-intelligent software recognizes what looks suspicious, much like a trained security professional could. However, unlike humans, it can do this thousands of times per second without missing information or getting tired.  How does Tessian prevent data exfiltration on email? Tessian uses stateful machine learning to prevent data exfiltration on email by turning an organization’s own data into its best defense against inbound and outbound email security threats.   We currently protect customers across industries, including those that are highly regulated like Legal and Financial Services. Our Human Layer Security platform understands human behavior and relationships, enabling it to automatically detect and prevent anomalous and dangerous activity like data exfiltration attempts and targeted phishing attacks.  Importantly, Tessian’s technology automatically updates its understanding of human behavior and evolving relationships through continuous analysis and learning of the organization’s email network.  Tessian Enforcer detects and prevents data exfiltration attempts by: Analyzing historical email data to understand normal content, context, and communication patterns Establishing, mapping, and continuously updating every employee’s business and non-business email contacts into relationship graphs  Performing real-time analysis of outbound emails before they’re sent to automatically predict whether the email looks like data exfiltration. This is based on insights from relationship graphs, deep inspection of the email content, and previous user behavior Alerting users when data exfiltration attempts are detected with clear, concise, contextual warnings that reinforce security awareness training Click here to download the data sheet. Tessian Defender detects and prevents data exfiltration attempts by: Analyzing historical email data to understand normal content, context, and communication patterns Establishing, mapping, and continuously updating every employee’s business and non-business email contacts into relationship graphs  Performing real-time analysis of inbound emails in real-time to automatically predict whether the email looks unsafe. This is based on insights from relationship graphs, deep inspection of the email content, and previous user behavior Alerting users when targeted email attacks are detected with clear, concise, contextual warnings that reinforce security awareness training Click here to download the data sheet.

We are proud to say that Tessian has received a 451 Firestarter award from leading technology research and advisory firm 451 Research.   The 451 Research Firestarter program recognizes exceptional innovation within the information technology industry. Introduced in 2018 and awarded quarterly, the program is exclusively analyst-led, allowing its team of technology and market experts to highlight organizations they believe are significantly contributing to the overall pace and extent of innovation in the technology market.  In its recent spotlight report, 451 Research said: “Most existing data discovery and data loss prevention (DLP) tools try to discover ‘personally identifiable information’ (PII) like credit card, driver’s license and social security numbers using RegEx searches, fingerprinting or optical character recognition (OCR). In contrast, Tessian’s focus is on finding bad behavior rather than finding sensitive data or PII, by applying machine learning techniques to historical email messages (headers, body and attachments) in order to distinguish between ‘safe’ and ‘unsafe’ emails.”

Earlier this year, 451 Research wrote a report stating that the “the DLP market is ripe for change” and that modern enterprises are looking for next-generation solutions that can detect and prevent both inbound email attacks and outbound email threats. Being recognized as a 451 Firestarter is a recognition of Tessian’s innovative approach to data loss protection. Book a Demo To learn more about how we prevent inbound and outbound email threats and why world-leading businesses like Arm, Man Group, Evercore, and Schroders trust Tessian to protect their people on email, book a demo.

The relationship between mental wellbeing and work is being talked about now more than ever.  We’re all experiencing different emotions around the current global pandemic and seeing firsthand that if we don’t manage our stress and anxiety, we can’t be productive or thrive in our roles.  At Tessian, we put mental wellbeing at the top of our list of priorities because we know it’s critical to the health and success of our employees. We’re approaching this head on by launching our new mindfulness program — TesWell. TesWell runs for 4 weeks and covers topics like building a mindfulness practice, growing in resilience, understanding emotions, creating habits, and teaching employees how to have difficult conversations. The program is a proactive step to give all Tessians the tools to learn how to grow in openness, awareness, and presence in each moment so we all feel more resilient towards changing circumstances.   Resilience has become especially important during COVID19; we’re all having to adapt to changing work environments. But, we think it’s important to share some of the insights that have been the basis of this new program. This way, people outside of Tessian can support mental wellbeing in their own workplace.

1. Mental wellbeing starts with a conversation One of the most powerful ways you can foster mental wellbeing (or support mental health problems) in your workplace is simply to talk about them — this is the first step to normalizing mental health problems and reducing the stigma around them.   This is important because when we feel we’re able to speak up about our mental health at work, it means we can get ahead of problems and prevent them from spiraling. We’ve found there are many ways to get the conversation started. For example, sharing posts on Slack channels about mental wellbeing (we’ve even created a channel dedicated to wellbeing). Managers have even more opportunities to initiate these conversations. How? By intentionally (and frequently) speaking to people about their own wellbeing.  In a recent session we held with our managers on mental wellbeing, we had some great suggestions on how to start the conversation. These ranged from making sure managers are asking their team members how they’re feeling during 1:1 check-ins to encouraging managers to share their own stories of how they’re coping during this time.  This second point is of particular importance. Leaders must shed light into the darkest corners of their own journey so others know they are not alone in their own fight. This allows employees to feel safe and to begin speaking up about their own mental health challenges.  Think of it as an exercise in empowerment. 2. Leaders need to role-model healthy behaviors Leaders can role-model healthy, stress-reducing behaviors such as taking regularly scheduled breaks, engaging in walking meetings, and going offline at a reasonable hour rather than being available all the time.  We’ve found that using our calendars to demonstrate these healthy behaviours can spark others to feel it’s okay to do the same. For example, taking an hour and a half lunch break to go out for a run and eat lunch, taking a proactive mental health day (and labeling it this way in your calendar), or simply scheduling “meditation” at any point during the day — these are all great ways to do this.  3. Create programs that signal mental wellbeing as a top priority  There are many initiatives companies can implement during COVID19 like TesWell that signal to employees that their wellbeing is important. This could be programs related to physical activity or initiatives that provide social interactions with others (even in this remote world). The point is to help remind employees  that staying healthy requires a holistic approach — we have to nurture our bodies and minds and offer self-compassion to ourselves.  So, make it a priority to help people develop good habits. How? offer meditation, mindfulness, yoga or even a free fitness membership like ClassPass.  The bottom line? You can foster mental wellbeing for your company simply by talking about it.  

Mental wellbeing starts with a conversation. It’s our job, then, to ensure we create a safe space to facilitate those conversations and implement programs so our people know their mental health is a priority.   Whether virtual or in-person, at Tessian, we’re Human First.

Over the last eight weeks, security vendors, thought leaders, and even mainstream media have been offering employees advice on how to stay secure and productive while working from home. And, why wouldn’t they? The transition from office-to-home has been both sudden and challenging and the risks associated with data loss haven’t disappeared just because the perimeter has. At Tessian, we’ve created (and have been consistently updating) our own remote-working content hub filled with actionable advice for security, IT, and compliance professionals as well as employees. While you can find the individual articles below, we thought we’d combine all of the tips we’ve shared over the last two months into one easy-to-read article. Advice from Security Leaders for Security Leaders: How to Navigate New Remote-Working Challenges Ultimate Guide to Staying Secure While Working Remotely  Remote Worker’s Guide to: Preventing Data Loss Remote Worker’s Guide to: BYOD Policies  11 Tools to Help You Stay Secure and Productive While Working Remotely  Here are 13 things you shouldn’t do when working remotely from a cybersecurity perspective.  1. Don’t send company data to your personal email accounts. As many organizations have had to adopt new tools and systems like VPNs and Cloud Storage on the fly, some employees may have had to resort to sending company data to their personal email accounts in order to continue doing their job.  We understand that doing so may have been viewed at the “only option”, but it’s important to note that this is not wise from a security perspective. While we’ve written about this in detail on our blog The Dark Side of Sending Work Emails “Home”, the short-and-sweet version is this: Personal email accounts are less secure and more likely to be compromised than work email accounts. Why? Read point #5 to find out.  2. Don’t share Zoom links or Meeting IDs.  Zoom – like so many other remote-working tools – is enabling workforces around the world to continue collaborating despite being out-of-office. But, as we highlighted in our Ultimate Guide to Staying Secure While Working Remotely, there are precautions you must take in order to prevent attackers from infiltrating your calls. While there are plenty of lists circulating with top tips around using Zoom, the most important piece of advice we can offer is to not share your Zoom Meeting ID (or link) with anyone you don’t work with directly or otherwise trust.  Importantly, this Meeting ID appears at the top of your conference window, which means if you share a screenshot of your call, anyone who sees the screenshot can access this meeting. If you want to be proactive in locking down your Zoom calls, you should also ensure all of your meetings require a password to join. 3. Don’t ignore warnings from IT and security teams or other authoritative sources.  Since the outbreak of COVID-19, we’ve seen a spike in phishing attacks. Why? Because hackers tend to take advantage of emergencies, times of general uncertainty, and key calendar moments. IT and security teams and even organizations like the FBI have been working hard to communicate these threats and how to avoid them. But – importantly – these warnings are useless unless employees heed the advice.  Whether it’s an email outlining how to spot a phishing email or an announcement from your line manager about updating your iOS, employees should take warnings seriously and take action immediately.  4. Don’t work off of personal devices.  While it may seem harmless, using your personal devices – whether it’s a laptop, desktop computer, mobile device, or tablet – for work-related activities creates big security risks. To start, your personal devices won’t be configured with the same security software as your work device.  Whether it’s the protection offered by a simple firewall or antivirus software, you and your data are more secure when working on company-sanctioned devices. Note: Some organizations have adopted more flexible BYOD policies. You can learn how to combat the security risks associated with these policies on our blog. 5. Don’t action email requests without double-checking their legitimacy.  Phishing and other social engineering attacks are designed for one of three reasons: to extract sensitive information or credentials, to install malware onto a network, or to initiate a wire transfer. To avoid falling victim to one of these scams and potentially actioning a request that isn’t legitimate, make sure you double-check that the person making the request is who they say they are.  For example, if your CEO asks you to change an account number on an invoice, contact him or her directly – via phone call, text, Slack or a separate email – before doing so. Likewise, if someone in HR asks you to share any credentialsor other personal information, get in touch with them via phone or a separate email thread before responding.  6. Don’t use weak passwords.  Many organizations have strict password policies, including the enforcement of multi-factor authentication. It makes sense. If a bad actor gained access to your applications – whether it’s your email account or collaboration tools – they’ll have free rein over your most sensitive systems and data.  If your organization doesn’t have any policies in place, our advice is to use 6-digit PINs or complex swipe codes on mobile devices and strong passwords that utilize numbers, letters, and characters for laptops and other log-ins.  If you’re having trouble managing your passwords, discuss the use of a password manager with your IT department. 7. Don’t lose touch with your IT or security teams.  Communication – especially during periods of transition and disruption- is key.  If you’re unsure about any security policies or procedures, how to use your personal device securely, or if you believe your device or network has been compromised in any way, don’t be afraid to communicate with your IT and security teams. That’s what they’re there for. Moreover, the more information they have and the sooner they have it, the better equipped they are to keep you and your devices protected.  8. Don’t use public Wi-Fi or mobile hotspots.  Given the digital transformation, most of us rely on internet access to do our jobs. Unfortunately, we can’t connect to just any network.  The open nature of public Wi-Fi means your laptop or other device could be accessible to opportunistic hackers. Likewise, if a phone is being used as a hotspot and has already been compromised by an attacker, it’s possible it could be used to pivot to the corporate network. With that said, you should only use networks you’re absolutely confident are secure.  9. Don’t download new tools or software without approval.  IT and security teams have processes in place that help them identify which applications are and aren’t in compliance with their data and privacy protection criteria. That means that if they haven’t approved the use of a certain tool, it probably isn’t safe in their opinion. Even if a certain tool makes your job easier to do, you shouldn’t download – or even use – tools or software without express permission to use them. Whether it’s a design, writing, or project management tool, you must communicate with your in-house teams before clicking “download”.  10. Don’t leave work devices or documents in plain sight.  Your devices are gateways to sensitive information. While we’ve already covered the importance of password-protecting these devices, preventing them from being stolen is vital, too.  Avoid leaving laptops, tablets, mobile devices, and documents containing sensitive company or client information in plain sight, such as near windows at home or on a passenger seat if traveling by car. This will help prevent opportunistic theft.  Any organization that has a remote-working policy in place should also provide employees with privacy screens for their laptops, and encourage employees to always work in positions that minimize line-of-sight views of their screens by others. This has the added benefit of showing clients or other professional contacts that the business takes security seriously. 11. Don’t give hackers the information they need to execute social engineering attacks.  When planning a spear phishing attack – a type of phishing attack that is targeted at a specific individual or small set of individuals – an attacker will try to gather as much open-source intelligence about their target as they can in order to make the email as believable as possible.  Don’t make it easier for them by sharing personal information on OOO messages or on social media like LinkedIn. This includes phone numbers, alternative email addresses, travel plans, details about company structure and reporting lines, and other data points.  12. Don’t be afraid to ask questions about security policies and procedures.  When working from home or otherwise outside of the office, you have much more autonomy. But that doesn’t mean you should disregard the processes and policies your organization has in place. And, part of following processes and policies is understanding them in the first place. IT and security teams are there to help you. If anything is unclear, send them an email, pick up the phone, or file a request.   13. Don’t forget the basics of security best practice.  While we’ve offered plenty of advice that’s specific to remote-working, following general security best practices will help prevent security incidents, too.  Most employees receive annual security training or, at the very least, had some security training during their onboarding process. If you didn’t, below are some of the basics. Don’t reuse passwords. Don’t share your passwords with anyone. Stay up-to-date on compliance standards and regulations specific to your industry. Report incidents of theft. Don’t share sensitive company information with people outside of your organization.  If any of the above are unclear, refer back to point #7. Ask your IT, security, or HR teams. Communication is key! What’s next? While most organizations and individuals have started to adjust to “the new normal”, it’s important to remember that, eventually, some of us will move back to our office environments. The above tips are relevant wherever you’re working, whether that’s at home, from a cafe, on public transport, or at your desk in the office. Looking for more insights on what\s next in this new world of work? We’re hosting our first virtual Human Layer Security Summit on June 18. Find out more – including the agenda for the day – here. 

On June 18, we’re hosting Tessian Human Layer Security Summit and you’re invited.  The theme? The new world of work. While businesses have flexed fast to adapt to remote-working, there are still plenty of challenges security, compliance, and IT leaders have to overcome.  That’s why we’re bringing thousands of people together from around the world – including over a dozen speakers and partners – to discuss what’s happened and (more importantly) what’s next. We know what you’re thinking: How is this virtual event different from others you’ve been invited to or attended? We’ll tell you.

1. You’ll hear from thought leaders from world-renowned institutions We believe that diverse perspectives lead to better solutions, which is why we’ve brought together such a wide range of voices from the world’s top businesses and institutions.  We’ll be welcoming security and business leaders from Amazon Web Services, The FBI, Unilever, Investec, and more and each speaker will cover a topic that demonstrates their expertise and unique point of view. So, what will they be covering? The evolving risk landscape, how new compliance standards affect business and cybersecurity strategies, challenges in preventing data loss, and how to build and maintain a happy and productive remote workforce.  2. You’ll have a chance to ask your most pressing questions around cybersecurity, remote-working, and business continuity While the agenda is jam-packed with fireside chats, presentations, and panel discussions, we’ve left plenty of time for you to voice your thoughts, too. After all, the name of the game is diverse perspectives. We’ll be opening the floor to all attendees to ask their most pressing questions and our speakers will answer them live. You can even submit your questions ahead of time by emailing [email protected] This way, you can leave the event with actionable advice related specifically to you and your organization. 

3. You’ll learn more about human-centric security strategies  The Human Element has been a buzzword throughout 2020. But, do you know how to create and implement security strategies that are human-centric? You will after this event. You’ll hear why solving the problem of human error on email is more important now than ever, how security and privacy risks have evolved as the perimeter has disappeared, and how Tessian’s Human Layer Security platform has helped Tessian customers prevent data loss incidents on email.  Want a sneak peek at what you might learn? Check out these insights from the world’s first Human Layer Security Summit.  4. You’ll be the first to know about exciting company and industry news  While we don’t want to spoil all the surprises, you should know that we’ll be announcing some very exciting news that will bring greater visibility into threats specific to your organization.  Not only will we be unveiling new technology that gives security, IT, and compliance leaders a birds’ eye view into data loss trends, but we’ll be sharing key findings from our groundbreaking research into the State of Data Loss Prevention 2020. 

5. You’ll be in good company  We hosted our first-ever Human Layer Security Summit in March where hundreds of attendees (both in-person and online) joined the conversation. This event will be even bigger. Thousands of leading C-suite executives, business leaders, and security professionals from across continents will be under the same (virtual) roof which means this event is the perfect opportunity to network and connect with the larger cybersecurity community.  Whether you’re looking for advice, allies, or future opportunities, this is your chance, especially considering all of our incredible partners for the event: HackerOne, Noord, The SASIG, Women in Security and Privacy, and Security Current. 6. You don’t have to change out of your pajamas While most of us are all too familiar with challenges around remote-working, we can’t ignore that there are some benefits, too. For example: Being able to ask the former CEO of Upwork a question while sitting in your pajamas.  This is especially relevant for those tuning in from California, as the event kicks off at 7:00 AM PST. Of course, feel free to join in whatever you’re comfortable in.  7. …It’s free! Attendees have a lot to gain by joining us on June 18 and nothing to lose; the event is 100% free.  All you have to do is register now to save your spot and tune in on the day.  Can’t make it on June 18? Don’t worry! By registering, you’ll have on-demand access to watch the full series of keynotes, panel discussions, and more after the live session.

While cybersecurity policies, procedures, and solutions are often focused on cybercriminals outside of the organization, more and more often, it’s people inside the organization who are responsible for data breaches. In fact, there’s been a 47% increase in incidents over the last two years; this includes accidental data loss and deliberate data exfiltration by negligent or disgruntled employees or contractors. This is a big problem, especially considering the global average cost of an insider threat is a whopping $11.45 million.  So, what is an insider threat and how can organizations protect themselves from their own people?

Importantly, there are two distinct types of insider threats, and understanding different motives and methods of exfiltration is key for detection and prevention. Types of Insider Threats The Malicious Insider

Malicious Insiders knowingly and intentionally steal data. For example, an employee or contractor using valuable information (like Intellectual Property, Personally Identifiable Information (PII), or financial information) for personal gain. What’s in it for the insider? It depends. Financial Incentives Data is valuable currency. Case in point: data brokering is a $200 billion industry…and this doesn’t even include the data that’s sold on the dark web. Whether it’s a list of customer email addresses or trade secrets, bad-intentioned employees with privileged access to systems and networks can cause serious damage to an organization’s bottom line and reputation. Competitive Edge It’s not uncommon for employees to download, save, send, or otherwise exfiltrate work-related documents before leaving a job or after being dismissed. While this isn’t always malicious (they could simply be adding a project to their portfolio), it certainly can be. For example, an exiting employee could take customer lists or trading algorithms to a new employer.  The prevalence of these incidents varies greatly by industry. Unsurprisingly, highly competitive industries like Finance Services, Government, and Entertainment have the highest percentage of occurrences.  The Negligent (or Unaware) Insider 

Negligent or unaware insiders are just your “average” employees doing their jobs. Unfortunately, to err is human, which means people can – and do – make mistakes. While there are a number of ways employees can mishandle data, the common thread here is that data leaks are unintentional.  Sending a misdirected email Data emailed to the incorrect recipient is the second most reported cause of data breaches. And, while it’s unintentional, the implications can be far-reaching, especially for those organizations that are bound to compliance standards or data privacy regulations. Think about it: emails contain structured and unstructured data in either the body copy, as attachments, or both. In certain industries – like healthcare and financial services – the likelihood of email communications containing sensitive information is even greater.  Falling victim to a phishing or spear phishing attack Phishing and other social engineering attacks are designed for one of three reasons: to extract sensitive information or credentials, to install malware onto a network, or to initiate a wire transfer. If the attack is successful – meaning the target (an employee) falls for the scam – there could be serious consequences.  If you want more information, read this article: Phishing vs. Spear Phishing: Differences and Defense Strategies. Losing your work device(s)   Whether it’s a mobile phone, laptop, or tablet, losing a work device could lead to a data breach, especially if the device is left unlocked.  How can I protect against Insider Threats? While organizations are certainly aware of the risks around insider threats, preventing breaches caused by malicious or careless employees is a challenge. Why? Because to detect and prevent threats, IT, security, and compliance teams have to maintain full visibility over data – both digital and physical – including who has access to it. This is no easy task. You must consider all the different perimeters (networks, endpoints, and email), take stock of the massive amount of data that your organization handles, and identify all of the employees, contractors, and other third-parties who have access to that data.  From there, it comes down to training, monitoring (both digital and physical), and the implementation of security policies, procedures, and tools.  Training Education is one of the first steps in prevention, which means malicious and accidental insider threat awareness should be incorporated into periodic security training for all employees. While training won’t prevent those with nefarious intent from exfiltrating data, it will help build a positive security culture in which employees outside of IT and security teams will know how to identify an insider threat.  Beyond that, making employees aware of the dire consequences of mistakes on email will help encourage safe and secure data handling. Monitoring Today, most sensitive data is stored on networks, devices, and the cloud, which means controlled access is absolutely essential. But, if an individual has legitimate access to a system or network, how can IT or security teams know if and when they’re exfiltrating data? Monitoring.  Telltale signs of an insider threat include: Large data or file transfers Multiple failed logins (or other unusual login activity) Incorrect software access requests Machine’s take over Abuse by Service Accounts   Of course, insider threats can still steal physical data like sensitive documents. This is one reason why controlled access to buildings and even certain offices is just as important as network security.  Security Policies, Procedures, and Tools Many organizations look to Data Loss Prevention (DLP) strategies to help mitigate risk around insider threats.  Solutions include: Firewalls Endpoint scanning Rule-based systems Anti-phishing software Machine learning technology  Unsure what exactly DLP is? Read this article: A Complete Overview of DLP. What is the best Insider Threat Solution? While there are a number of ways in which malicious or careless employees can exfiltrate (or otherwise lose) data, email is no doubt the number one threat vector.  Billions of email messages are sent every day to and from organizations and many of these emails contain highly sensitive information including personal details, medical records, intellectual property, and financial projections. That means that in order to have a chance at detecting and preventing insider threats, organizations must look at securing email communications. But, traditional DLP solutions for email fall short and today, machine learning technology is the only way to prevent data loss and data exfiltration.  In fact, Tessian was recently recognized as a Cool Vendor in Gartner’s Cool Vendors in Cloud Office Security report. Why? Because, through a combination of machine intelligence, deep content inspection of email, and stateful mapping of human relationships, Tessian’s Human Layer Security Platform prevents misdirected emails and intentional (and malicious) attempts at data exfiltration.  How does Tessian detect and prevent Insider Threats? Tessian turns an organization’s email data into its best defense against inbound and outbound email security threats. Powered by machine learning, our Human Layer Security technology understands human behavior and relationships, enabling it to automatically detect and prevent anomalous and dangerous activity like data exfiltration attempts and misdirected emails.  Importantly, Tessian’s technology automatically updates its understanding of human behavior and evolving relationships through continuous analysis and learning of the organization’s email network.  Tessian Enforcer detects and prevents data exfiltration attempts by: Analyzing historical email data to understand normal content, context, and communication patterns Establishing, mapping, and continuously updating every employee’s business and non-business email contacts into relationship graphs  Performing real-time analysis of outbound emails before they’re sent to automatically predict whether the email looks like data exfiltration. This is based on insights from relationship graphs, deep inspection of the email content, and previous user behavior Alerting users when data exfiltration attempts are detected with clear, concise, contextual warnings that reinforce security awareness training Tessian Guardian detects and prevents misdirected emails by: Analyzing historical email data to understand normal content, context, and communication patterns Establishing, mapping, and continuously updating every employee’s business and non-business email contacts into relationship graphs  Performing real-time analysis of outbound emails before they’re sent to automatically predict whether the email looks like it’s being sent to the wrong person. This is based on insights from relationship graphs, deep inspection of the email content, and previous user behavior Alerting users when a misdirected email is detected with clear, concise, contextual warnings that allow employees to correct the recipients before the email is sent

This month we celebrate the two year anniversary of the General Data Protection Regulation (GDPR). While the road to compliance hasn’t been easy for organizations in Europe and beyond, it’s clear this benchmark legislation has been a step in the right direction for data rights, privacy, and protection.  It’s also had a big impact on cybersecurity. Not only is cybersecurity now considered business-critical – which is big news for an industry that has historically struggled to communicate its value and ROI – but we’ve seen incredible innovation in security solutions, too. Read on to learn more about how GDPR has affected cybersecurity or, for more context around GDPR and its implications, read GDPR: 13 Most Asked Questions + Answers.  1. Cybersecurity is now a business enabler  While cybersecurity has historically been a siloed department, data privacy regulations and compliance standards like GDPR have helped prove the business value of a strong cybersecurity strategy.  To start, cybersecurity solutions help organizations stay compliant by preventing data breaches. This isn’t trivial. While the fines under these new compliance standards are hefty (GDPR fines totaled nearly €50 million in the first quarter of 2020 alone), the implications of a breach extend far beyond regulatory penalties to include: Lost data Lost intellectual property Revenue loss Losing customers and/or their trust Regulatory fines Damaged reputation It’s no surprise, then, that the UK’s cybersecurity sector has grown by 44% since GDPR was rolled out. But, cybersecurity solutions don’t have to be limited to prevention or remediation. In fact, cybersecurity can actually enable businesses and become a unique selling point in and of itself. Now that data protection is top of mind, those organizations that are transparent about their policies and procedures will have a competitive advantage over those that aren’t and will gain credibility and trust from prospects and existing customers or clients. 

2. IT leaders are engaging with (and depending on) employees more often While cybersecurity teams are responsible for creating and implementing effective policies, procedures, and tech solutions, data protection is the responsibility of the entire organization. Why? Because data loss is a human problem with 88% of breaches being caused by human error, not cyberattacks. The fact is, employees control business’ most sensitive systems and data, and one mistake – whether it’s a misdirected email or a misconfigured firewall – could have tremendous consequences. That means accountability is required company-wide in order to truly keep data secure and stay compliant.  But, education is the first step in prevention which is why there’s express advice contained within the GDPR to train employees. Importantly, though, training has to actually cut through and stick, which means IT leaders are working hard to effectively communicate risks and responsibilities. Of course, anyone in a cybersecurity leadership position knows this is no easy task.  The key is to ensure training is aligned to the individual business, starting with the people in it and their attitudes towards security. Not sure where to start? Watch Mark Lodgson, Head of Cyber Assurance and Oversight at Prudential, talk about how he measures cyber culture within his organization. 3. The DLP market is booming  Post-GDPR, organizations are spending more than ever to protect their systems and data, and, unsurprisingly, one of the top spending priorities for IT leaders is data loss prevention (DLP). While the DLP market is keeping up with demand (DLP market revenues are projected to double from $1.24 billion in 2019 to $2.28 by the end of 2023), data loss prevention remains a pain point for most senior executives because, well, most DLP solutions don’t work. According to a new report from 451 Research “DLP technology has developed a reputation as much for inaccuracy, false positives, and poor performance as it has for protecting data.” The shortcomings of DLP solutions are reflected in the number of incidents of data loss and data exfiltration being reported, too, up 47% over the last two years. The problem is that most DLP solutions rely on rules to detect and prevent incidents and most rules cannot effectively be managed by people. It’s too time consuming and complex to update them in tandem with evolving human relationships and compliance standards. But, there’s a better way: machine learning. In fact, Tessian was recently recognized as a Cool Vendor in Gartner’s Cool Vendors in Cloud Office Security report. Why? Because, through a combination of machine intelligence, deep content inspection of email, and stateful mapping of human relationships, Tessian’s Human Layer Security Platform turns your email data into your biggest defense against email security threats.  To learn more about how Tessian uses machine learning to prevent data loss on email, click here.  What’s next? GDPR is just the beginning and the CCPA enforcement date is looming. Are you prepared? Find out on our blog: 5 Things Every CISO Should Know About CCPA’s Impact on Their InfoSec Programs.