Rational Survivability

IT is still it's own worst enemy

Your comment of "so much for insider risk trumps all" is misleading. If you read the blog post from the Verizon Business Security Blog it states:
"While criminals more often came from external sources, and insider attacks result in the greatest losses, criminals at, or via partner connections actually represent the greatest risk. This is due to our risk equation: Threat X Impact = Risk
* External criminals pose the greatest threat (73%), but achieve the least impact (30,000 compromised records), resulting in a Psuedo Risk Score of 21,900
* Insiders pose the least threat (18%), and achieve the greatest impact (375,000 compromised records), resulting in a Pseudo Risk Score of 67,500
* Partners are middle in both (73 39% and 187,500), resulting in a Pseudo Risk Score of 73,125"
[Source: http://securityblog.verizonbusiness.com/2008/06/1… ]
This data is located in a table on page 11 of the report which states: "Thus, a 'back of the napkin' calculation of risk (likelihood x impact) finds that partners represent the greatest risk for data compromise, followed closely by insiders."

Although excellent reports like this gives us insight into breaches that are found, one wonders the number of additional breaches that are NEVER detected.

Great post. The monitoring part is often overlooked. I saw an article the other day in Computerworld, that discussed a mult-billion dollar insider incident at Société Générale.
One of the things they mentioned was that IT management had implemented all of the controls recommended by auditors, but nobody was monitoring them.
It's not the technical controls in most cases – it's people/process shortfalls that will get you.

To expand on what Rob said: All this being said, and as good a read as it is, don't forget it is documenting only 500 incidents they knew of in a period of 4 years (an eternity for those of us in technology). I wouldn't consider these 500 to be all incidents. Not to mention threats evolve in 6 months, let alone 4 years. Heck, even Symantec's report is based only on stuff they see. Fun read, though.

These are breaches that they did forensics on, IIRC. They may or (as I suspect) may not represent all breaches. Would a business need forensics experts to figure out that an unencrypted backup tape they sent via courier never showed up, for example? When you consider that the majority of exposed records [that we know about…] are exposed via lost or stolen media or gear…

I am enthusiastic about the richness of detail as well — don't get me wrong. I would like to see way more of this.

I think one of the most understated implications is related to virtualization security. If most of the threats are from the outside against targets not known by the security team (perceived as safe or inaccessible) then what happens when you bring in the hypervisor layer (more hidden changes/mutation), which adds more change and less visibility for perimeter appliances?
Amrit- you have a point about insiders doing great damage… but I think the real point has to do with cost/benefit when it comes to security. IMHO insider betrayal is a very old phenomenon that will never go away. Creating the perfectly safe network impervious to insider damage by way of a powerful, super smart network appliance seems to be a Quixote Windmill fraught with new levels of "brick and mortar" restrictions and limitations. Maybe that is what Bruce is up to in his new collaboration with the social sciences. Maybe convenience isn't a good thing?
At the end of the day I would supplement the equation with a factor identifying the likelihood of solving the problem and the expense of addressing. That way netsec focuses on achievable tasks based on business case versus theoretical, abstract exercises.
Who knows, maybe some of these insider events were predictable or avoidable (with some unobtrusive solutions in place), but my instinct is that insider risks are better dealt with within the legal system.

@Sam,
My gut instinct is that there is a larger percentage of inside violations of policy (eg. printing out extra hard copy or copying to portable device) that are never detected than the percentage of externally sourced attacks that are never found.

Excellent points at th end – Some colleagues of mine are on the cusp of releasing some research done on the analysis and vetting of breach data sources. Stay tuned!

@Amrit, for years and years and years and (did I say years) my inbox got clutter with marketing/press pitches that included the phrase, or close variants, of "and it's widely known that 80 percent of attacks are from insiders."
Never a mention of magnitude. Never a qualification.
While that may have been widely known, it was also widely wrong.
And for what it's worth, this is probably based largely on TruSecure's reports — which were good in their time.