Cybersecurity continues to be of deep concern to global CEOs. In fact, it was ranked as the fourth-biggest threat to company growth in 2020 – rising a spot from the previous year – according to PwC’s 23rd Annual Global CEO Survey released recently. There is a reason for all this worry.

According to the Identity Theft Resource Center, the number of U.S. data breaches tracked in 2019 increased 17 percent from 2018, with 1,473 data breaches exposing more than 164 million sensitive records. Even more alarming, the issue of data breaches appears to be getting worse.

Consider this:

From January 2019 through June 2020, at least 16 billion sensitive records have been exposed globally. These records include credit card numbers, home addresses, and phone numbers. That’s not all. The first quarter of 2020 has been one of the worst in data breach history, with more than eight billion records exposed globally, according to the RiskBased Security 2020 Q1 Data Breach QuickView Report.

Overlooking What’s Right in Front of Us

Certainly, these attacks can cause massive damage to any business, which is why so many CEOs worry about them and spend great sums of time and money to try to prevent them. Unfortunately, all of this focus on external attacks has caused us to overlook – and prevent – potential insider threats created by employees, contractors, and other trusted associates who have easy access to your network.

According to the Ponemon Institute’s Cost of a Data Breach Study, along with hackers, malicious insiders are the leading cause of data breaches. What’s more, incidents caused by insiders tend to have larger costs than other breaches.

The study reported that, over the last two years, the number of insider incidents has increased 47%. While that is shocking, this is even more so: A staggering 60% of organizations suffered more than 30 incidents per year.

Here’s even more bad news: Over the same period, the cost of insider threats has increased by 31%, with the average insider incident now costing organizations $11.45 million.

Are You Next?

Don’t believe these types of insider incidents can happen? Last year, Canadian banking group Desjardins suffered a data breach that affected some 2.7 million people and around 173,000 companies. The stolen information included names, addresses, dates of birth, social insurance numbers, email addresses, and information on customers’ transaction habits. The source of the breach? An employee with “ill-intention,” according to Desjardin.

While malicious insider activity can be devastating, it is still not the norm. According to the Ponemon Institute study, two out of three insider threat incidents are caused by employee and contractor negligence. In other words, when an employee or contractor plugs what appears to be a harmless USB flash drive or smart phone into an open port, it can be the triggering event for an insider threat incident.

Insider threats aren’t going away anytime soon. In fact, they are getting worse. According to the Cybersecurity Insiders 2020 Insider Threat Report, 70% of organizations are reportedly seeing more frequent insider attacks.

More Need to Be Done

So why aren’t we doing more to stop insider threats? Maybe it’s because the solution seems so daunting that no one knows where to begin. If that describes you and your organization, let us suggest the first, easiest, and least-costliest step is to lock all of you open computer and network ports. If employees, contractors, and others cannot access your network through open ports, then a large part of your problem is solved. So, you might be thinking that anyone can simply unplug a port connection that is in use and plug in there. Yes, they can, which is why you need to lock your active connections, too.

While USB port locks, network module locks, LAN cable locks, and secure USB hubs for your attached USB devices aren’t foolproof – if someone wants to access your ports badly enough, they’ll find a way – they serve as an effective deterrent to both the malicious and unintentional threat. The malicious threat would certainly be noticed trying to destroy and bypass a port lock, while the unintentional threat would be thwarted entirely simply by not being granted access to your ports.

If the cost of locking all your ports seems more than you can bite off, first consider that port locks cost as little as $4, and then consider that the average cost of an insider incident is now $11.45 million and rising.

On which side of this financial equation do you want to be?