The Insider Threat: A Pocket Guide

Data Loss Prevention is easier and cheaper than cure! The insider threat poses a significant and increasing problem for organizations. The use of highly connected computers makes controlling information much more difficult than in the past. This is shown by the regular stories of data loss in the media such as the 25 million personal records mailed out by Revenue and Customs in the UK. In addition, we do not know enough about the insider threat, as of course many attacks are unknown to their victims or are not made public. An Insider Attack - this is the execution of a latent threat by an insider to achieve their goals, which usually has a detrimental effect on the organization. They are often straightforward to perpetrate without detection using their legitimate access or acquiring unauthorized access using their knowledge of system weaknesses to defeat the controls. We need to understand what is valuable to insiders and their likely methods of attack to determine the necessary defensive measures. We believe that the insider threat is a difficult problem that requires systematic analysis to mitigate. This new pocket guide intends to shed light on the key security issues facing organizations from insiders to get them up to speed quickly. It is written by Clive Blackwell who is a researcher at Royal Holloway, University of London, where his main field is security architecture. He has developed a practical three-layer security architecture to model computer networks such as the Internet and other complex systems such as critical infrastructure. He is currently applying the model to the insider threat within different business sectors, which has resulted in several academic papers. Clive is a regular speaker on security at both academic and business conferences in the US and Europe as well as the UK. He has recently been invited to give talks on the insider threat at two major business conferences. He has about 20 publications to his name within the last two years. He also runs his own IT security consultancy, Advanced Computer Services, so he is aware of the security issues facing business.