Securing Against Insider Attacks

e are all creatures of habit; the way we think and the views we take are conditioned by our education, society as a whole, and, at a much deeper level, our cultural memories or instinct. It is sometimes surprising how much the past can unconsciously affect today’s thinking. George Santayana famously observed, “Those who cannot remember the past are condemned to repeat it.” But when it comes to IT security, a better way of thinking might be, “Those who fail to understand the impact of the past on their thinking may find themselves somewhat exposed.” The integration of the Internet — a public network — into the communication framework of most organizations has significantly changed the way IT security is implemented in virtually every business environment. And up until now, the primary basis for most security strategies to deal with this has been the “moat and castle” model: a strong perimeter is established that divides the environment into a trusted interior and untrusted exterior, with security focused on establishing the perimeter, enforcing access control strategies, and securing data as it flows from exterior to perimeter. This approach to security is hardly new. Tribal defense is a tried and trusted remedy for a hostile world and has at its base a survival trait that has served us well for millions of years, right back to the time when prehistoric man first started to walk upright and cluster together into groups for defense against a very hostile world.