Insider threats are individuals within an organisation itself, such as employees, contractors or business partners that have authorised access to a pharmacy’s systems, data, or facilities, making them potential threats due to their knowledge, privileges, and proximity to sensitive data. However, it is crucial to recognise that not all insider threats are intentional or malicious. Many incidents involving insiders arise from negligence or a lack of awareness rather than a deliberate attempt to cause harm.

Insider attacks can result in devastating losses for organisations, as reported by the Ponemon Institute in their 2023 Cost of Insider Threat Global Report, which shows that the total average cost of insider threats has risen from $8.3 million in 2018 to $16.2 million in 2023. Insider attacks can result in a range of negative outcomes, including facing penalties for failing to comply with cybersecurity regulations, as well as loss of customer trust and confidence.

Understanding insider threats

Insider threats can manifest in various forms, including:

• Negligent behaviour: Employees may inadvertently compromise security through careless actions, such as falling for phishing scams, mishandling sensitive data, or unintentional breaches due to lack of awareness or training;
• Malicious intent: Insiders with malicious intent may intentionally misuse their access privileges to steal data, sabotage systems, or engage in fraudulent activities for personal gain or to harm the organisation; and
• Compromised accounts: Insider threats can also arise from external actors gaining unauthorised access to an employee’s credentials or accounts through techniques like phishing or social engineering, allowing them to pose as insiders and exploit organisational resources or data.

Insiders may exploit weaknesses in:

• Access controls: Inadequate access controls can enable unauthorised individuals to gain entry to restricted areas or systems. For example, a pharmacist would need more access to pharmacy systems than a sales assistant in the same pharmacy;
• Data handling practices: Poor data management practices can lead to data leaks or breaches, whether intentional or accidental, for example, throwing out outdated patient records into the regular trash instead of shredding and destroying these records securely; and
• System security: Weak passwords, unpatched software, or unsecured devices can create vulnerabilities that insiders may exploit.

How do we protect ourselves from insider threats

• Employee education and training: Implement regular cybersecurity training to educate employees about the risks of insider threats and best practices for safeguarding sensitive data;
• Access management: Implement strict access controls to limit employees’ access to sensitive data and systems based on their roles and responsibilities. Regularly review and update access permissions as needed;
• Monitoring and auditing: Use monitoring tools to track employee activities and detect unusual behaviour or suspicious access attempts. Conduct regular audits to ensure compliance with security policies and procedures;
• Incident response planning: Develop a thorough incident response plan to promptly address and mitigate insider threats when they occur. Define clear protocols for reporting and investigating suspicious activities; and
• Culture of security: Foster a culture of security within your pharmacy by promoting awareness, accountability, and transparency regarding cybersecurity practices. Encourage employees to report potential security incidents or concerns promptly.

As pharmacies entrusted with sensitive patient information, safeguarding against insider threats is paramount to maintaining trust and integrity. The IPU is dedicated to helping pharmacies understand the nature of insider threats and implementing proactive security measures, to strengthen your defences and remove the risks posed by malicious insiders.

Access more cybersecurity articles, posters, and guides at ipu.ie/cybersecurity.