The phenomenon known as “quiet quitting,” in which employees become disengaged from their work while formally remaining in their jobs, can lead to serious security risks, according to Tim Keary at VentureBeat. Apathetic employees are more likely to make security mistakes, such as falling for social engineering attacks or reusing passwords. Particularly unhappy employees may also intentionally harm the organization by leaking data.
Jeff Pollard, VP Principal Analyst at Forrester, stated, “It’s important to be aware of quiet quitting, so a quiet quitter doesn’t become a loud leaker. Leading indicators for quiet quitting include an individual becoming more withdrawn becoming apathetic towards their work. If those feelings simmer long enough, they turn into anger and resentment, and those emotions are the dangerous leading indicators of insider risk activity like data leaks and/or sabotage.”
Jon France, CISO of (ISC)2, stated that the spike in remote work due to the pandemic has increased this risk.
“While quiet quitting is a relatively new term, it describes an age-old problem — workforce disengagement,” France said. “The difference this time around is that in a remote work environment, the signs may be a little harder to spot. To prevent employees from quiet quitting, it is important for CISOs and security leaders to ensure and promote connection and team culture.”
Keary concludes that organizations can mitigate these risks by following security best practices.
“One of the simplest solutions is to implement the principle of least privilege, ensuring that employees only have access to the data and resources they need to perform their function,” Keary says. “This means if an unauthorized user does gain access to the account or they attempt to leak information themselves, the exposure to the organization is limited. Another approach is for organizations to offer security awareness training to teach employees security-conscious behaviors, such as selecting a strong password and educating them on how to identify phishing scams. This can help to reduce the chance of credential theft and account takeover attempts.”
New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize social engineering attacks.
VentureBeat has the story.
Here's how it works:
