Problem solve Get help with specific problems with your technologies, process and projects.

Is insider activity or outsider activity a bigger enterprise threat?

According to Verizon's 2008 Data Breach Investigations Report, outsider activity is much more likely to be the cause of a data breach than insider activity. Does that mean security managers are spending too much time worrying about insiders? Security management expert Mike Rothman weighs in.

In Verizon's 2008 Data Breach Investigations Report, I read that 73% of data breaches involved outside activity. Most security pros I talk to consider insider activity to be the biggest threat. Do you think this perception -- and subsequent over-focus on inside activity -- could be partly responsible for so many breaches?
Don't read too much into the data that Verizon released early this year. There were some interesting aspects of the study, but it's important not to draw generic conclusions. (There aren't many generic environments, so trying to use generic data to make decisions is pretty dangerous.)

The distinction between insiders and outsiders isn't very useful. Security pros just shouldn't trust anyone. Proper controls must be in place to protect data from both internal and external attack vectors. Whether the right number is 73% or 27% doesn't matter if an insider has created a breach. Or an outsider, for that matter.

Reading deeper into the Verizon report (pdf), it's clear that many of the breaches could have been avoided by updating devices on a timely basis and making sure configurations were locked down. Again, both of these issues are pretty simple security practices. People should focus on protecting important data rather than making artificial delineations between insiders and outsiders.

The last point is that Verizon's data set is skewed toward outsiders. Many insider attacks are never reported, nor do they bring in fancy forensic investigators (like Verizon) to clean up the mess. Yet, when the breach happens from outside, organizations usually have to disclose and tend to bring in outside experts.

Verizon's study definitely has value; it's opened up the eyes of a lot of people. But it's important to put it in the proper frame of reference and make sure to draw the right conclusions.

More information:

This was last published in September 2008

Dig Deeper on Data security breaches

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.