governance risk compliance

Basic Compliance and the Risks from Insider Threat

Basic compliance involves conformation to some specific rules, like policy, specification, law and standard, etc. Basic compliance also describes the long-term objectives of corporations and all concerned personnel are required to be aware of them. Because of the ever growing need for accountability and operational transparency, corporations are adopting all the harmonized and consolidated controls for basic compliance.

The cornerstone for the successful compliance operations includes effective management of procedures and policies. However, the varying nature of regulatory environment of basic compliance makes it difficult for all those people who are directly or indirectly involved in taking care of procedures and policies and the associated compliance programs. Compliance officers are required to supervise and organize a lot of data from different groups of the corporation. Besides, they must control the information flow among several internal as well as external stakeholders (e.g. regulatory agencies).

Probably, the biggest security threat faced by compliance officers is the insider threat. Although this threat may not be in the top 10 list of every compliance officer, history has been the witness to several occasions when sensitive data flowed out of corporations premises. Unfortunately, these threats are posed by none other than the most entrusted compliance personnel of organizations. For example: system and database administrators have unaudited and uncontrolled access to most of the sensitive data stored either on desktops or on network files systems.

However, insider threats are not limited to the access of privileged and sensitive data only. In fact, this threat is all about access to any form of intellectual property or data that carries some business value. Insiders who are involved in one or other form of abuse of the access privileges are also called the malicious insiders. Malicious insiders mainly use their laptops or mobile devices (such as: pen drive, compact disc, cell phone, et.) to copy information and this way they commit electronic crimes and break the rules of basic compliance. Now, the copied information is mostly downloaded to personal computers or sent through mail to some interested party.

Surprisingly, most organizations are yet to take the insider threats seriously. They neither track nor document the insider threats; instead they resort to the same old methods of access control. These conventional access controls can be easily circumvented by the personnel with privilege access.

So what are the solutions there for saving the basic compliance rules from being broken by the malicious insiders? Before moving any further, an organization would have to understand that this insider threat can’t be tackled with technology alone. Organization would have to start by documenting all the potential insider threats first. Then the organization needs to ask some questions to itself, which can be as follow:

• What data is confidential or sensitive for organization and why?
• What could be the level of risk for the organization in case of loss or stealing of sensitive data?
• Which personnel have limited to privileged access to what data, where the access could be to create, update, read or manage the data?
• Which are the methods of access to data and from where, e.g. laptops in home?
• What are the loopholes in the compliance rules that need to be sorted out?
• What are the measures that could be relied on in case of a security threat, like mitigation or elimination of threat?

Once the organization finds the answers to all of these questions and starts working accordingly, there would be no need to worry much about the breaking of basic compliance rules.