We might be prone to considering breaches caused primarily by cybercriminals hacking corporate networks. But data show – especially in the case of phishing attacks – are most often facilitated unknowingly by employees or insiders. In fact, the most recent Verizon Data Breach Investigations Report (DBIR) revealed that 30 percent of breaches are caused by an internal actor. In many cases, there are personality types associated with employees who are most susceptible to phishing attacks.

Also important to remember is that the majority of internal breaches aren’t malicious. Plenty of cyberattacks are designed specifically to exploit tired, overworked, or otherwise unobservant employees, profiting directly from often-made mistakes that humans are particularly susceptible to – human error.

With that in mind, preventing data breaches isn’t as simple as network-focused protections from outside attack. Also key, is understanding causes of internal breaches, and the potential red flags that employees might be flying —consciously or not. Here are 6 personality types that might make an employee more at-risk:

1. Overly Eager Employees
   An employee who is overly eager to impress the CEO is one who is also more likely to fall for spear phishing attacks—especially if they’re new to a company or work in departments like finance or HR, both which makes them prime targets for attackers. By adding extra people to email chains, this type of employee is also more likely to open personal data up to unauthorized access. Lending these employees a hand by flagging incorrect email recipients (often a sign of spear phishing attempts) can be a big help.
2. Overconfident Employees
   Chances are, this employee has been at the company for a while, and has been through security training a number of times. They probably even consider themselves knowledgeable about security in general— and feel confident that they’re far less likely to fall for silly email scams than their colleagues. Confidence can quickly become overconfidence, and employees who think they know best are less likely to pay attention to potentially risky behavior.  Unfortunately, they often don’t know best, and having automated email security in place can help avoid leaving the organization vulnerable.
3. Overly Tired Employees
   Whether from working too late, a vigorous nightlife, heavy travel or keeping odd hours, an overly tired employee can be less effective than their well-rested counterparts and be more prone to mistakes that carry heavy consequences. Beyond completing required training sessions, they might be otherwise disengaged and more likely to make simple errors like sending the wrong attachment, emailing the wrong person, or forgetting to use the BCC field. The ability to detect incorrect email recipients can go a long way toward avoiding the damage that tired employees can cause
4. Reckless Employees
   An employee considered “reckless” from a security perspective might simply “not have time” for the extra steps that many security tools add. An employee meeting this profile is generally more than happy to cut corners, possibly even use software programs that he prefers rather than the ones the organization has provided him with, even as he/she thinks they might be “helping the company” by enabling him/her to get the job done faster.  This behavior may violate company policy and risk exposing valuable information, Correcting is best through training and, if necessary, formal performance review measures. Having tools in place to automate security for potentially sensitive data can provide a valuable backstop against future reckless behavior, and is far better than having to deal with a breach that has already happened.
5. Sneaky Employees
   An employee considered “sneaky” might be eager to advance his/her career, whether at their current firm or with a competitor. When changing jobs, they might send a list of clients or other valuable information to their personal email address to give themselves a head start at the new job and avoid losing years of valuable contacts and relationships.

   Exfiltrating privileged data is itself a data breach, regardless of whether a person feels that they have ownership of data. What’s more, removing it from the corporate network, where it is protected, to a personal email address with unknown security carries obvious risks. Today, there are tools capable of detecting anomalous email behavior and even blocking certain data from being shared inappropriately, making it harder for an employee or former employee to expose their employers to this sort of risk.

6. Disgruntled Employees
   Perhaps an employee was passed over for a promotion at work, or disciplined for something that they didn’t believe put them at fault. Or mad at the boss for perceived mistreatment, or having a personal gripe with a political stance the company has taken. Whatever the case, an agitated or disgruntled employee has strong feelings of resentment against his or her employer and is likely to attempt to exfiltrate valuable data.

   Having tools in place that understand what constitutes normal and abnormal behavior and compliance reporting as appropriate can help put a stop to this behavior—or at least make administrators aware of it before it does any serious harm.

By implementing today’s technology tools and understanding employees’ behaviors and the specific mistakes they’re likely to make—as well as the underlying causes— you can put appropriate protections in place to not only prevent breaches from happening, but allow employees to correct their own errors before they are made.

Read article in its entirety here.