Ask the Expert

Is insider activity or outsider activity a bigger enterprise threat?

In Verizon's 2008 Data Breach Investigations Report, I read that 73% of data breaches involved outside activity. Most security pros I talk to consider insider activity to be the biggest threat. Do you think this perception -- and subsequent over-focus on inside activity -- could be partly responsible for so many breaches?

    Requires Free Membership to View

    Login

Don't read too much into the data that Verizon released early this year. There were some interesting aspects of the study, but it's important not to draw generic conclusions. (There aren't many generic environments, so trying to use generic data to make decisions is pretty dangerous.)

The distinction between insiders and outsiders isn't very useful. Security pros just shouldn't trust anyone. Proper controls must be in place to protect data from both internal and external attack vectors. Whether the right number is 73% or 27% doesn't matter if an insider has created a breach. Or an outsider, for that matter.

Reading deeper into the Verizon report (pdf), it's clear that many of the breaches could have been avoided by updating devices on a timely basis and making sure configurations were locked down. Again, both of these issues are pretty simple security practices. People should focus on protecting important data rather than making artificial delineations between insiders and outsiders.

The last point is that Verizon's data set is skewed toward outsiders. Many insider attacks are never reported, nor do they bring in fancy forensic investigators (like Verizon) to clean up the mess. Yet, when the breach happens from outside, organizations usually have to disclose and tend to bring in outside experts.

Verizon's study definitely has value; it's opened up the eyes of a lot of people. But it's important to put it in the proper frame of reference and make sure to draw the right conclusions.

More information:

This was first published in September 2008

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top