We have Met the Enemy

Insider Threat Study - "The enemy is us"

There are no reliable statistics on misuses of privileged access. After all, companies won't report such embarrassing incidents unless they are required to do so by law. Intentional and malicious breaches by privileged users make up only a small minority of all breaches. But they keep recurring and their incidence doesn't seem to be diminishing. And when they do happen, the damage can be significant.

After all, the more lucrative the assets, the more likely that it will take privileged access or technical expertise to exploit them. It's problem that festers in secret wherever assets are not guarded well enough. The only way to prevent such breaches is to be more careful about those you hire, more vigilant with those you trust, and more painstaking about monitoring how access is handled.

In most cases, perpetrators have technical expertise. According to the Insider Threat Study: Illicit Cyber Activity in the Information Technology and Telecommunications Sector, published in January 2008 by the CERT program of Carnegie Mellon University, 63 percent of the insiders were employed in technical positions, including engineers (25 percent); system administrators (22 percent); programmers (22 percent); information technology specialists (14 percent); and other technical positions (14 percent).

Eighteen percent were employed in a professional position such as sales specialist, account manager, editor or analyst. Of the remaining insiders, 7 percent were employed in executive management or supervisory management positions; 7 percent worked in customer server positions; and 5 percent held administrative / clerical support positions.

These figures indicate that many, if not most, breaches come from those with IT privileges which proves "The enemy is us".