By Dan Hounsell, Senior Editor

Healthcare organizations looking to avoid problems created by the ongoing waves of cyber attacks — especially from inside their ranks — have a new resource at their disposal.

The Cybersecurity and Infrastructure Security Agency (CISA) released an Insider Risk Mitigation Self-Assessment Tool, which aims to assist public and private sector organizations in assessing their vulnerability to an insider threat. By answering a series of questions, managers can receive feedback they can use to gauge their risk posture. The tool will also help managers further understand the nature of insider threats and take steps to create their own prevention and mitigation programs.

“While security efforts often focus on external threats, often the biggest threat can be found inside the organization,” said David Mussington, CISA executive assistant director for infrastructure security. “CISA urges all our partners, especially small and medium businesses who may have limited resources, to use this new tool to develop a plan to guard against insider threats. Taking some small steps today can make a big difference in preventing or mitigating the consequences of an insider threat in the future.”

Insider threats can pose serious risk to any organization because of the institutional knowledge and trust placed in the hands of the perpetrator. Insider threats can come from current or former employees, contractors, or others with inside knowledge, and the consequences can include compromised sensitive information, damaged organizational reputation, lost revenue, stolen intellectual property, reduced market share, and even physical harm to people.

CISA has a number of tools, training, and information on an array of threats public and private sector organizations face, including insider threats. Information on these resources can be found at CISA.gov.