Evolving Face Of Insider Threat

LALIT CHACKO

GM – IT INFRASTRUCTURE & SECURITY OPERATIONS, IBM INDIA

“It’s time the CIOs, CTOs, CISOs take cognizance of the lurking insider threat from a growing workforce which is, complacent, inept, ignorant, averse to change, working in silos and apathetic to the management”

Technology, process and policies have evolved to counter Insiders threats in organizations to a large extent but the new age threats from complacent, ineptitude, ignorant, change averse teams that work in silos and management apathy that builds such environments might still jeopardize them.

Following are a couple of definitions of ‘Insider Threat’ from globally well-known and trusted knowledge sources. (Wikipedia) - ‘An insider threat is a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization’s security practices, data and computer systems” (CERt.org) - “Insiders pose a substantial threat to your organization because they have the knowledge and access to proprietary systems that allow them to bypass security measures through legitimate means. “

Do these definitions cover the entirety of insider threat? Is insider threat limited to insiders with knowledge and access?

NOT at all, It’s time that the management particularly the CIOs, CTOs, CISOs take cognizance of the lurking insider threat not because of “who have inside information” or “malicious intent” or “knowledge and access to proprietary systems” but a growing workforce which is, “complacent, inept, ignorant, averse to change , working in silos and apathetic to the management”.