Skip to main content

How to Identify High-Risk Employees for Cyberattacks

By William Vogeler, Esq. on December 06, 2017 | Last updated on March 21, 2019

'We have met the enemy and he is us.'

So said Pogo, or whoever thought of if first. The point is, your own people present the biggest threat of a cyberattack.

That's because they share the malware, leave the back door open, and otherwise invite the enemy in for dinner. Here's who they are and how they do it.

Because lawyers communicate online more than ever, they are continually at risk of a cyberattack. DLA Piper, a BigLaw global firm, is a recent example.

The firm prides itself on cybersecurity, but like airplane disasters, most of the time it's due to operator error. DLA Piper had to shut down its digital operations around the world while it tried to figure out what happened.

Attorneys are targets for ransomware because they deal in information and they have money. If they use insecure email, websites or networks, they are practically inviting hackers to the party.

As general counsel, it's not enough to train your legal department. Outside counsel and service providers mess up, too.

High-Risk Users

Companies should identify high-risk users and intervene. In addition to training workers, employers need to monitor how they use technology.

Harvard Business Review recommends analytics to review users, track data and address negligent or malicious actions. For example, high-risk behavior includes:

  • Accessing, moving, or deleting large volumes of sensitive content
  • Inappropriately creating, storing, or sending sensitive content
  • Extreme negative sentiment towards the organization in messages

Employees should be advised they have no privacy when using company computers, networks, and phones. They should also know that compromising cybersecurity is a serious offense.

Related Resources:

Copied to clipboard