Black hats are baddie hackers, white hats are goodies, grey hats will sell IP to kids in hoodies

Quite hard to prove an insider job too.

Its possible to know data accessed, but if nothing *obviously* done with that data (& user has legit reasons to access the data) then nothing obviously bad has occurred.

If decent measures in place (e.g. no external USB / bluetooth devices allowed, no user devices on wifi network, restricted internet access so no copying to third party site / emailing data to someone, logs of any files created / printed by the user and their contents, company mobiles locked down & monitored, etc, etc, etc.) still cannot be sure no data "theft" as a quick (personal) mobile phone photo or several can capture a lot of useful data when e.g. having opened customer database as part of legit fault fixing...

I'm sure plenty of places suspect data theft but have no proof unless the thief left traces.

Though I would be more suspicious of the manager / sales people in data slurping than the IT bods as its much rarer an IT person (compared to sales etc staff) goes to work for a competing company in same market area as a lot of alternative IT options, less so for sales staff in a particular "niche" area (& lets face it, a certain subset of sales staff have a rep for taking their contacts list with them from job to job as part of the job offer made to them is based on the value of their relationships with customers in their "area" of sales).

The fifth column

When Franco was conquering Spain in their civil war, he was reported as having four columns of troops outside Madrid and a "fifth column" of supporters inside.

Most large organisations have many staff who are happy to collect their monthly pay, yet spend a significant amount of effort actively or passively working against their employers interests. Whether those people are actively sabotaging or betraying the company or government department they work for or are just goofing around, doing nothing useful is debatable.

However, it should be recognised that there is a broad spectrum of hostility that does not begin or end with selling the company's IP, phone directory, confidential material or client data. While that can never be stopped entirely, there are basic fixes that are easy, yet rarely implemented.

One would be forced to conclude that even simple things like removing USB connections to PCs and scrutinising outgoing email are not common simply because organisations do not care about security. Preferring to think any breaches are down to lone-wolf employees who are outliers. That mind-set is far more acceptable (to both employers and employees) than recognising that 5% of your staff are crooks!

"47 per cent of insider threats stemmed from maliciousness of one sort of another, with the remainder caused by carelessness."

Hanlon's razor has some statistical backing then, but it's close.

Oh why don't they ever offer me money

I could certainly use a 2nd house, 3rd car, boat, plane, island, etc.

But no, no one with bags of money has ever offered me anything for what I might be able to extract. Even with I worked for a company in the top .5% of the Fortune 500.

Ask black hats how common black hats are...

When I've talked to companies, the executive leadership are so terrified of insider threats, so out of proportion to the actual risk, that often they create a bigger security risk by giving the security team, the very team most likely to go black hat, massive access to every piece of intellectual property in the company, even if they don't actually need that access, because security.

Then I talk to the black hats of security, penetration testers, and they talk about insider threats as the number one source of problems.

Then I sit down and look at the company, and see that the top source of risk isn't a malicious actor at all, and often isn't even adversarial, but structural due to their failure to invest in basic IT. Surveys like this aren't very useful except for fear mongering and encouraging further black hat activities by people with security jobs.

Secret documents for sale cheap

just contact me torturersrus@cia.com

greys dont screw over their employers, blacks do

greys will help their employers by viable means, not screw them.