1. Introduction to Data Threats

• Threats to data refer to potential harm or loss due to malicious or unintentional actions.
• Data breaches involve unauthorized access, disclosure, or destruction of sensitive data.
• Categories of threats: Internal and External.

2. Internal Threats

• Definition: Arise from individuals within the organization misusing access or knowledge.
• Common sources:
  • Employees (current or former)
  • Contractors or third-party vendors
  • IT staff with privileged access

Types of Internal Threats

1. Malicious Insiders: Employees intentionally harming systems or stealing data.
2. Negligent Insiders: Employees causing harm due to carelessness or poor security practices.
3. Privilege Abuse: Unauthorized use of elevated access rights.

Case Study: Edward Snowden (2013)

• Former NSA contractor leaked classified information.
• Resulted in a significant breach of national security and loss of public trust.

3. External Threats

• Definition: Originates outside the organization from hackers, cybercriminals, or nation-state actors.
• Sources:
  • Cybercriminals
  • Hacktivists
  • Nation-state attackers
  • Competitors

Types of External Threats

1. Phishing Attacks: Fraudulent emails tricking users into revealing sensitive data.
   • Example: 2016 U.S. Presidential Election Email Hack (DNC targeted via phishing).
2. Denial-of-Service (DoS) Attacks: Overloading a system to make it unavailable.
   • DDoS (Distributed DoS): Multiple sources attack simultaneously.
3. Malware & Ransomware: Malicious software designed to harm or exploit systems.
   • Example: WannaCry (2017) ransomware attack on global organizations.
4. SQL Injection: Exploiting database vulnerabilities to manipulate or extract data.
   • Example: 2009 Heartland Payment Systems Hack (100+ million card numbers stolen).

4. Comparison: Internal vs. External Threats

5. Security Measures

For Internal Threats

1. Access Control: Apply the principle of least privilege (PoLP).
2. Employee Monitoring: Log analysis and behavior tracking.
3. Security Awareness Training: Educate employees on best practices.
4. Incident Response Plan: Rapid response to insider threats.

For External Threats

1. Firewalls: Prevent unauthorized access.
2. Antivirus/Anti-malware: Detect and block malicious software.
3. Encryption: Protect sensitive data.
4. Intrusion Detection & Prevention Systems (IDS/IPS): Monitor and block threats.

6. Mitigation Strategies

• Layered Security Approach: Multiple defense mechanisms to prevent attacks.
• Regular Audits & Assessments: Identify vulnerabilities through security reviews.
• Comprehensive Security Strategy: Address both internal and external threats for robust protection.