Insider threats and data breaches: they’re not always what you think …
Insider threats and data breaches: they’re not always what you think …

insider threats by modern gangsterThere’s something you should know before you invest your entire IT and information security budget on technical solutions – if a smart thief wanted to steal your intellectual property and/or your client’s confidential information (e.g., credit, financial, and contact information taken during the Equifax data breach), they’d act like a gangster and walk in the front door and take it.


Why? When it comes to protecting what’s worth stealing, it’s your employeesnot your computers, that are the weakest link


Employees are within the human resources (HR) wheelhouse, so this is a topic of great importance to me. Some years ago, I worked in an organization that invested a lot of effort to keep its intellectual property and confidential employee information protected. This was done in two ways: (1) careful hiring and HR processes and (2) technical measures including firewalls, information security protocols, etc. Both approaches were necessary. It hasn’t become a popular concept, as yet, but it’s easy to argue that cybersecurity alone is not enough.




Many of us have heard of Edward Snowdon, the former NSA Subcontractor who disclosed an immense volume of confidential information to journalists and online sources. After working in an organization that shares some similarities with the NSA, I think it’s safe to say that the presence of sophisticated technical measures was not enough to prevent the intentional disclosure of confidential information. In fact, this scenario is an example of an Insider Threat.


“Insider threats can be defined as risks posed by rogue employees who deliberately cause harm, or by those who may be negligent in the workplace.


insider threats - snowdon a patriot or traitor


Some insider threats are non-malicious or accidental, whereas others are malicious and intentional. Malicious threats may be driven by principles or ideology (e.g., Edward Snowden), or they could be motivated by anger or disenchantment in the workplace. A malicious insider threat can also develop when someone on staff is recruited and groomed by an outside organization” (Corporate Security Hinges on its People, FrontLine Security Magazine, October 2017).



If insider threats are a real problem why isn’t it better known?


analog insider threats

Not all data breaches are external or digital …

Most of us have heard about data breaches that have occurred in organizations that have much bigger security budgets than ours. For example, the NSA and Equifax breaches that I just mentioned. Plus, there have been big breaches at Yahoo, Home Depot, Target, and others. I’ve done extensive research on this topic and one thing is crystal clear: 75% of these data breaches originate inside organizations. Often, we don’t hear about the causes of those breaches because they make the organization look terrible. It has a negative impact on the public’s trust and confidence in the organization’s ability to protect corporate information, including clients’ and/or customers’ personal information. When an organization experiences a security breach, their current and future clients, strategic partners/affiliates, and members of the general public are likely to see the organization as irresponsible. Negative financial consequences usually follow. Approximately 60% of smaller companies are bankrupt within 6 months of a major security breach, so it’s no wonder this is kept quiet.


How can HR, based on I/O psychology help?

I’m addressing this topic because I understand that HR has an important role to play in preventing these insider threats. One problem is that most organizations don’t recognize that HR can make valuable contributions to the risk management process. Another problem is that the C-suite and the IT/information security folks don’t necessarily recognize the role that HR could be playing to keep confidential intellectual property and client information from leaking out of the organization. For example, many organizations don’t address workplace bullying as proactively or completely as they could. They haven’t understood the link between malicious insider threats that are inspired by anger or a desire for revenge that comes from being severely mistreated at work. The consequences of ongoing suffering in toxic workplaces are even more severe when essential government services and critical infrastructure are at risk. So, if the threat of lost productivity and lawsuits aren’t a big enough justification for improving HR policies and practices, the likelihood of insider threats should catch the attention of key decision-makers.


If you’d like to learn more about how psychology and HR can help prevent insider threats, listen to Episode 27 of The Insider Threat Podcast where I speak to host Steve Higdon about this topic. Note – since the time that this article was published, I was an invited guest on Scott Wright and Tom Eston’s Shared Security Podcast and we spoke about different aspects of this issue.


Have a sensitive career or HR-related concern? I invite you to contact me by emailphone, or via direct message on Twitter, Facebook, or LinkedIn if you’d like to discuss any of these topics in more detail.


More than career coaching, it’s career psychology®.


I/O Advisory Services – Building Resilient Careers and Organizations.


Easily share this article using any of the social media icons below!

Latest Posts

Using Inclusive Leadership Styles

Using Inclusive Leadership Styles

Due to the rapidly evolving world and workplace, it’s time to challenge conventional styles of leadership and reshape how we think about guiding teams and organizations. Beyond the traditional notions of authority and direction, inclusive leadership stands as a catalyst for change, amplifying the voices of every individual within an organization.

Destigmatizing Perimenopause and Menopause at Work

Destigmatizing Perimenopause and Menopause at Work

Although the symptoms associated with perimenopause and menopause are private – these are issues that women can’t “leave at home.” These are symptoms that follow employees to work. Ignoring the impact of perimenopause and menopause symptoms won’t lessen their impact and won’t contribute to psychological safety or productivity.

A Snapshot of Black Psychologists in Canada

A Snapshot of Black Psychologists in Canada

Although the CPA did not believe collecting disaggregated demographic data was a priority, the Black Psychology Section executive members started to collect this data as an interim measure. The Section’s hope and expectation is that the CPA and the various provincial and territorial Colleges of Psychology will ultimately take on this responsibility since they are connected to all psychologists working in Canada through the process of accreditation.

Things to do after you’ve been laid off …

Things to do after you’ve been laid off …

Certain experiences are common, but that does not make them easy to manage. Being laid off is one of those problematic yet common experiences.
In this blog article, I’m offering some ideas to support the thousands of people who are dealing with being laid off.