Software Engineering Institute

The 2011 CyberSecurity Watch Survey uncovered that more attacks (58%) are caused by outsiders (those without authorized access to network systems and data) versus 21% of attacks caused by insiders (employees or contractors with authorized access) and 21% from an unknown source; however 33% view the insider attacks to be more costly, compared to 51% in 2010.  Insider attacks are becoming more sophisticated, with a growing number of insiders (22%) using rootkits or hacker tools compared to 9% in 2010, as these tools are increasingly automated and readily available.

Not only are insider attacks monetarily costly, but they also cause additional harm to organizations that can be difficult to quantify and recoup.  Harm to an organization's reputation, critical system disruption and loss of confidential or proprietary information are the most adverse consequences from insider cybersecurity events, according to respondents.  The public may not be aware of the number of insider events or the level of damage because 70% of insider incidents are handled internally without legal action, which is consistent with the 2010 study.

"Technical defenses against external attacks and leakage of well-formatted data like social security numbers and credit card numbers have become much more effective in recent years," said Dawn Cappelli, technical manager of the Insider Threat Center at CERT.  "It is a much more challenging problem to defend against insiders stealing classified information or trade secrets to which they have authorized access or against technically sophisticated users who want to disrupt operations.  CERT has been working with government and industry groups to develop solutions to this problem using commercial and open source tools.  We invite organizations to share their insights with us."