Chapter 2 - Insider Threats

Abstract

The dangers related to insider threats are similar to the dangers caused by external attackers. The threats are similar but often overlooked because malicious insiders are not the faceless cyber criminals who are despised the world around. They are trusted employees, consultants, partners, vendors, and others who have legitimate reasons to be on the network. In some cases, they are even friends. Hollywood typically portrays the cyber criminal as a criminal genius with a keyboard, but most malicious insiders employ only minimal skills, such as logon, copy, delete, and send. By plugging an MP3 player into a computer on a corporate network, an insider can walk away with twenty-five gigabytes of confidential data in less time than it takes to get a cup of coffee—if the appropriate levels of incident prevention, detection and management safeguards are not in place and working in concert. Insider threats should be viewed from human, business, and technical perspectives. The organization must create policies and procedures that address the threats..