Home » Identity & Access » Access Control

Industry View

The Enemy Inside

A realistic approach to prioritizing actions to prevent privileged user or insider security threats.

By Kristin Gallina Lovejoy

Page 4

Bonus Control: Implement Security Awareness ("Neighborhood Watch") Training Programs. The first line of defense from insider threats is other insiders. In fact, according to a recent CERT study, most insider attacks were identified by other insiders. As a general rule, security awareness and training programs should cover all employees and contractors, define why security policies and procedures exist, define how they are enforced and outline what the consequences will be for infractions.

There are three "gotchas" associated with this control. First, the value of awareness programs degrades over time. Effective awareness programs must be REPEATED. Second, it is hard to justify the ROI for training. Therefore these programs are traditionally underfunded. Third, they are often conducted by personnel who lack teacher skills or by those with no security knowledge.

In Summary

Theodore Roosevelt once said, "The best executive is one who has sense enough to pick good people to do what he wants done, and self-restraint enough to keep from meddling with them while they do it." While we all know this to be true, we also need to recognize that without control and accountability, our privileged insiders can cause us the greatest harm.

With the ever-increasing reliance on the Internet and connected companies, the lines have disappeared between insiders, outsiders and traditional internal and external boundaries.

The root of internal compliance policies is to protect the rights and interests of the employees, including privileged users, and shareholders. The good news is that reducing the risk of insider attack by privileged users without inhibiting our business operations is possible. It just takes some common sense, a crash course in human psychology and a good dose of technical savvy. Or, in other words, "Speak softly and carry a big stick; you will go far." (Theodore Roosevelt)