By Mark Rodbert, CEO of idax

TalkTalk’s Dido Harding isn’t the first to receive cyber security advice from experts safely installed on the This Morning sofa, and she won’t be the last. British Gas, Vodafone, JP Morgan, and more recently online investment startup Nutmeg, have all played data-breach bingo. Since Ashley Madison hit the headlines, the view that it is ‘when’ not ‘if’ organisations will be breached has been widely accepted by many in banking and finance.

Interestingly retailers have been dealing with another form of theft since the beginning of time. They call it ‘shrinkage’ –  when stock leaves a store by a non-legitimate route. Surprisingly, most shrinkage is a result of thefts by staff, not shoplifting. Despite efforts to introduce more automation, retailers still need staff, so they’ve had to concentrate on mitigation rather than eradication.

The finance community would do well to take heed here. The biggest tool most companies have against any insider threats is a strongly worded statement. Even then though, in some cases access information is so poor that management can’t deliver on any threats. Too much attention is placed on preventing the shoplifter – the external attack.

So here are some lessons the finance industry can learn from retail cousins:

1. It’s opportunity not character
   Incredibly 90% of us would steal if we could get away with it; theft is about opportunity not character and retailers understand this. In a recent Loudhouse survey for Clearswift, 35% of staff said they would sell company data, some for as little as £100. Hiring people who you think won’t steal doesn’t make the problem disappear either. So, remove temptation by applying least privilege rigorously.
2. People steal in the absence of safeguards rather than economic gain
   40% of thefts in UK retail were carried out by unsupervised staff, particularly those in management and security. Employing a ‘capable guardian’, a system with the ability to understand what someone can access, and identify issue areas to management is essential.
3. The biggest threat is internal
   Retailers start to secure their assets with goods receiving, because that’s usually the biggest crime scene. According to Forrester, 36% of all data breaches result from the direct involvement of employees. A more expensive firewall or privacy tool won’t stop the growing insider threat. Introducing strong controls over who has access to what, will.
4. Keep a tidy shop
   If a shop window remains broken, people think that no-one cares. If you don’t appear to care who has access to your data, why will your employees be bothered? But, if you combine a strong culture, whereby everyone in an organisation from operations to investment is focused on data security, with technology that gives managers all of the information to manage their environments, you will send the strongest possible message to all.
5. Communication is key
   Shrinkage prevention relies on communication. Making security requirements clear from the start sets expectations. The presence of a CCTV camera in a shop for example, tells staff (and others) that someone is always watching. Guarding data requires an equivalent overarching presence.
6. Constant monitoring should be a part of a workflow
   Relying on quarterly reviews to clean up access rights because you don’t have the capability to manage risk during the mover and request process, is the equivalent of only switching on the CCTV on bank holidays. Reviews are especially important in large finance organisations as it’s common for staff to switch role and department. Things like email addresses won’t change, but access definitely should.
7. Be proactive – focus on the aim
   Retailers can’t afford for shrinkage to become a problem and neither can the banking and finance industries. Loss control requires serious, regular attention in the physical and electronic realms.

It’s much easier to defend your reputation against a breach committed by highly advanced cyber criminals than someone inside your own company.  Defending a breach caused by an insider instantly puts you on the defensive. It’s also much easier to deal with insider threats; it’s relatively long hanging fruit.  Whatever measures are put in place they must be backed up with a strong culture that values data security and your intellectual property and with proper access request and access review processes.