Generally, most employees think cyber threats are external entities — outsiders trying to break into the United States Postal Service® network through social engineering methods. Did you know that the people we work with every day can do just as much damage?
Known as insider threats, these individuals are a problem for many organizations, including the Postal Service™. Insider threats can be current and former employees, contractors, or vendors. They are especially dangerous because they have authorized access to an organization’s network. Malicious misuse of this access could have a negative impact on critical Postal Service systems and data.
While insider threat profiles vary by organization, here are three common types:
n Accidental Insider. We all make mistakes, but if your USPS-issued equipment has been lost, stolen, tampered with, or hit with a social engineering attack, it could compromise USPS® data. Don’t be afraid to report the incident. For more information, visit link.usps.com/2019/07/10/clever-deceptions.
n Malicious Insider. Sometimes known as disgruntled employees, these insiders purposely try to access or steal sensitive data like Social Security numbers or financial information. Common threat indicators include:
n Extreme changes in co-workers’ behavior or activities, such as excessive copying or downloading of sensitive materials;
n Unexplained foreign travel;
n Changes in personality or wealth;
n Unauthorized off-hour work; or
n Misuse of organization equipment.
n Third-Party Insider. The Postal Service relies on business partners or third parties to support critical business needs. While not a direct insider, these vendors have some degree of access to the USPS network. If they do not take proper precautions to protect their own network, they could unintentionally open our network to thieves. For more information, visit link.usps.com/2019/05/06/risky-business.
If you see evidence of an insider threat, contact the Cybersecurity Operations Center by sending an email to Cybersafe@usps.gov or by calling 866-877-7247. For more information about insider threats, visit blue.usps.gov/itweb/ciso/insider-threat-program.htm.
For general cybersecurity information, visit the CyberSafe at USPS® websites on Blue (blue.usps.gov/cyber/) and LiteBlue (liteblue.usps.gov/cyber/).
— Corporate Information Security Office,
Chief Information Security Officer
and Digital Solutions, 8-15-19
