Inside attacks are often the most dangerous because attackers are already familiar with your organization's computers, applications and security measures and know which actions might cause the most damage.  They have the advantage of working from the inside-out, so firewalls may not stop them! 

The National Threat Assessment Center of the U.S. Secret Service recently completed an Insider Threat Study, consider a few of the sobering facts this study uncovered:

• Most insider events were triggered by a negative event in the workplace.
• Most perpetrators had prior disciplinary issues.
• Most insider events were planned in advance.
• Only 17% of the insider events studied involved individuals with administrator access.
• 87% of the attacks used very simple user commands that didn't require any advanced knowledge.
• 30% of the incidents took place at the home of the insider using remote access to the organization's network.

In fact, a recent report from Ernst & Young reported that insider attacks against large companies cause an average of $2.7 million in damages, whereas the average outside attack costs only $57,000. 

Our point: most companies focus so much on securing the outside-in level of their network, that they forget about their most vulnerable area: the inside.  Network security is a very fast-paced world, and unless this is your core business it's hard--if not impossible--to keep up.  The two most common culprits of internal network breaches are:

• Disgruntled workers.  If you have current or former employees who hold a grudge against your company, they may decide to take revenge into their own hands. These individuals likely know the inner workings of your organization and may retain system access due to weak security policies. This concern has escalated in recent years because of increased outsourcing and organizational downsizing in both public and private sectors -- both of which can leave individuals bitter and hostile.  Keep in mind, not all insider threats come from current employees. They could also be consultants, contractors, temporary employees and close-knit business partners who have detailed knowledge of your company's information technology systems. They may also know how to hit your organization where it hurts -- by stealing, deleting or altering sensitive information or otherwise sabotaging your systems.
• Non-malicious employees.  When Jane's friend suggested she use a new software program to generate more sales leads, she was thrilled. She didn't know, however, that downloading this unauthorized software program from the internet onto her company laptop could do a lot more harm than good. Unfortunately, Jane not only downloaded the software, but also some hidden malware and phishing ploys that were quickly transmitted to the company network.  Unfortunately, those who use your company IT resources in ways they shouldn't (i.e., by storing content or playing games) comprise the vast majority of your employees.  Chances are, there are many people in your company today who take small liberties with your company network. They may check their personal e-mail, play games and do some online shopping while on the clock. While they can pose a significant security threat, it is rarely intentional.  As a general rule, these employees have a very limited knowledge of security practices and can put your company at risk simply through some bad habits or improper training. Others may come to work armed with a variety of devices and gadgets, all of which get plugged into their PC.  As harmless as their intentions may be, they still represent a security threat that needs to be harnessed. 

So what can you do to reduce the risk? 

Most of the time, simply implementing and enforcing policies, backed up by system-driven control will eliminate most of your risk.  The rest can be eliminated by a smart, well-planned network design.  It doesn't necessarily have to be a huge investment.  Here are some examples:

• Restrict accounts that access resources remotely. The majority of insider attacks use some type of remote access mechanism. If you offer VPN or dial-up access to your employees, consider limiting remote access accounts to those with a legitimate business need.
• Restrict the scope of the remote access. Don't automatically grant remote access users the same level of privilege that they would have in the office. You'll not only be protecting yourself against the insider threat, but also against the increased risk of malware propagation through a remote access link.
• Enforce the principle of "least privilege" throughout your organization. Every security professional knows the least-privilege mantra. Each user should have the minimum necessary set of permissions required to fulfill his/her job responsibilities.
• Perform regular security patch remediation. Believe it or not, many security vulnerabilities already have existing patches. By using them, you'll greatly reduce the likelihood of security threats -- from insiders as well as outsiders.
• Create effective security policies. After you set up the business rules that guide both human behavior and system settings, gain signatures from all employees, and strictly enforce those policies.
• Stress employee awareness and education. Educate your employees on what constitutes dangerous and/or unacceptable behavior, and reinforce these guidelines through regular security awareness campaigns. These efforts may include posters, seminars, and e-mail reminders of existing security dangers and how to avoid them.