"Modern Security Demands an Empathy-First Approach to Insiders"

Security teams have long focused on ransomware, hackers, and nation-state threat actors. External threats are considered more urgent and dangerous, with greater potential consequences for organizations. Security teams can easily identify the enemy and prepare for a fight from a psychological standpoint. However, it is essential to also focus on internal threats such as employees. Security teams cannot approach insiders in the same way they do external actors, primarily because they are not faceless enemies to be defeated, even if their impact can be just as damaging. According to Aberdeen Research, an insider is involved in one out of every three reported data breaches. A data breach caused by an insider can cost up to 20 percent of a company's annual revenue. It may be inappropriate for a security team to take a combative approach intended for outside threats when dealing with insider threats. Using an empathy-first approach to insider threats is a recommended alternative. Those involved in the investigation of an employee at the root of an incident must approach the situation empathetically and without judgment. Otherwise, the likelihood of that employee repeating the same error or becoming disgruntled, which could lead to an intentional incident, increases significantly. Approaching insider investigations with empathy necessitates a mental shift. It is the first step toward establishing trust in order to achieve the best possible outcome for the organization. Five important elements of an empathetic approach to insider investigations include connecting to understand, exploring unconscious biases, reassuring to support the partnership, educating, and taking action. Approaching insider investigations with empathy contributes to the development of a culture of trust, open communication, and respect. It creates and sustains a positive security culture and helps keep an organization's most valuable data safe and secure. This article continues to discuss taking an empathy-first approach to insider investigations.

MIT Technology Review reports "Modern Security Demands an Empathy-First Approach to Insiders"