The cyber enemy within ... Countering the threat from malicious insiders

The measures to be taken to counter threats from malicious insiders who may use their computer privileges to modify, remove, or prevent access to an organization's data are discussed. The information security community needs to consider new means of evaluating behaviours over months or even years, and for incorporating non-traditional evidence. Detection and a tamper-resistant logging and track-back mechanism must be in place so that essential details about the attack and the feedback to refine the security policies can be collected should an attack succeed. The use of automated technology to gather network insider information, modeling of users and networks, and advanced reasoning techniques to identify sophisticated attacks should be researched.