Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

The Rising Threat from Insiders – Get Your House in Order

Client Alert
November 16, 2021

What is Insider Threat?

As its name implies, an ‘Insider Threat’ originates inside an organization. An ‘insider’ is any person who has or had authorized access to or knowledge of an organization’s resources, including personnel, facilities, information, equipment, networks, and systems. ‘Insider threat’ can manifest from malicious, complacent, negligent or unintentional acts that negatively affect the integrity, confidentiality, and availability of the organization, its data, personnel, or facilities. Certainly, ‘Insider Threat’ can be an activity by a bad actor employee, but can also arise from an inadvertent or unknowing action inside an organization (such as an employee who unintentionally opens a phishing email or clicks on a malicious link).

Rising Frequency; Rising Costs.

Protecting against ‘Insider Threat’ is a data security concern for all organizations. The realities facing organizations today include:

  • The frequency and cost of preventing insider attacks is rising;
  • User negligence is the most common cause of a data breach; and
  • Insider threat deterrence must become a key element in a cybersecurity posture.

According to a 2020 study[1], the average global cost of ​insider threats​ rose by ​31% in two years and the frequency of these incidents spiked by ​47%​ in the same time period. The risk is also present for small and medium sized businesses (SMBs). While 72% of organizations reported an increase in insider attacks in 2020, 66% of key decision makers in SMBs do not think breaches are likely to occur. Only 14% of SMBs have any kind of breach defenses in place; the rest are vulnerable to potentially devastating cyberattacks[2]. While daunting, the reality of modern business dictates that companies of all sizes, in all industries, must be cognizant of cybersecurity issues and prepare accordingly.

How can your company guard against Insider Threat?

The following is a brief list of action items your company should implement to address ‘Insider Threat’:

  • Put it in writing – An organization’s security policy should include procedures to prevent and detect misuse of company resources, guidelines for conducting insider investigations, and the potential consequences to the individual. Written policies not only preserve continuity, but also clearly outline rules and expectations in the organization.
  • Train and educate – The Identity Management Institute states that employee education remains key to breach prevention, including cybersecurity awareness during onboarding and routine drills to practice attack and breach responses.
  • Dictate Acceptable Use – An organization should detail an organization’s rules and expectations regarding technology use. This includes considering acceptable behavior on networks and devices.
  • Be transparent about employee privacy expectations - Organizations need to balance reducing insider threats and protecting employee privacy. Communicate and educate employees regarding the security policy and IT rules. Explain the program's objectives, while training employees about their role in security.
  • Get Technical – Invest in IT and consult with legal and technical cybersecurity professionals to find a solution that works for your organization.

Prudent businesses will create and maintain written policies as it relates to cybersecurity and data protection. BMD can assist in crafting the policies and identifying proper security frameworks and connecting you with technical experts to implement. 

If you have any questions about whether your cybersecurity risks, and whether your business is protected, please contact BMD’s Cybersecurity Practice Leaders, Brandon Pauley at btpauley@bmdllc.com or Kyle Johnson at kajohnson@bmdllc.com.

[1] https://www.proofpoint.com/uk/resources/threat-reports/2020-cost-of-insider-threats and Cybersecurity Insiders’ 2020 Insider Threat Report.

[2] https://identitymanagementinstitute.org/government-cybersecurity-and-insider-threats/

CybersecurityBrandon Pauley
Client Alert

RNs and APRNs Take Note: Ohio Board of Nursing Mandates a New CE Reporting Period

April 29, 2026Ohio’s Board of Nursing has updated the continuing education reporting period for RNs and APRNs. Beginning March 26, 2026, CE credits must be completed between July 1 and June 30 of odd-numbered years, replacing the previous November to October timeframe.Client Alert

Ohio Med Spas: Peptide Do's and Do Not's

April 29, 2026Recent guidance from the Ohio Board of Pharmacy outlines key compliance requirements for med spas using peptides. While some peptide drugs are FDA approved, others are not or cannot be compounded. Med spa operators should ensure they source medications from licensed suppliers, avoid non-approved or “research use only” products, and follow all compounding and storage regulations to maintain compliance and avoid enforcement actions.Client Alert

Substance Use Disorder Providers: 42 CFR Part 2 Now Enforceable

April 15, 2026Updates to 42 CFR Part 2 are now enforceable, bringing significant changes to how substance use disorder (SUD) records are handled. The Final Rule aligns Part 2 more closely with HIPAA, introduces updated penalties, allows a single patient consent for treatment, payment, and operations, and adds new requirements for Notices of Privacy Practices. It also creates a formal definition of SUD counseling notes and imposes strict consent requirements for their use and disclosure. Providers should review and update policies to ensure compliance.Client Alert

AAA Introduces AI-Assisted Arbitrator for Certain Disputes

April 7, 2026The American Arbitration Association has introduced an AI-assisted arbitration platform designed to streamline certain document-based disputes. While a human arbitrator still makes the final decision, the technology can improve efficiency, reduce costs, and accelerate case resolution. Companies should weigh these benefits against considerations such as transparency, risk, and contractual requirements before adopting AI-assisted arbitration.Client Alert

Quiet Hours Texts and TCPA Claims: Consent Remains King as Courts Divide on Text Messages

March 31, 2026Businesses face increasing TCPA lawsuits over off-hours marketing texts, but recent court decisions highlight strong defenses. Clear consumer consent and updated terms and conditions can defeat many claims, while a growing number of courts are finding that text messages are not “telephone calls” under the statute. Proactive compliance measures, including clickwrap agreements and forum-selection clauses, are critical to reducing risk.
Older posts