See your link here
Insider threats happen less often, but with more impact
5 comments- IT TOPICS:Business Intelligence, Management, Security
Richard Bejtlich had a couple of good blog entries last week about the insider threat (first, second ). He correctly points out that the number of threats is much higher from external sources. He also argues that the controls we have in place and the options we have for dealing with insiders are much greater than we'll ever have for dealing with outsiders. But what he's missing is that so many of the controls we have are circumvented by the fact that we have to trust insiders, just so they can get their job done on a daily basis.
It's hard to differentiate between someone doing their job in a conscientious manner and someone who's maliciously attacking the system. It's easy to tell when an engineer is getting into the accounting database. But how well can most programs differentiate between the accountant paying a valid account and the same accountant paying a bogus invoice to their cousin Vinnie? How is a computer going to tell if the sales person is taking a copy of his contact list so he can make calls on the road and the same sales person taking the list to a competitor? The real answer is, it probably can't in either case.
A large part of the problem is that the insider threat isn't a purely technical threat. It involves making sure your HR department properly screened new employees when they were hired. It means the physical security of your site has to be considered. It requires the cooperation of multiple departments in the organization, something IT is not historically the best at.
Print
Email this
Digg this
