This provides more complete discussion in the sections where they appear and allows the multiple contexts for some ideas to be more fully understood. Conclusions are presented at the end of the synopsis. The insider attack is best recognized by internal monitoring of personnel activities. That raises the issue of how to avoid turning all workers into watchers. The trick is to develop monitoring methods without spreading distrust throughout the workplace.
Current emphasis is on keeping outsiders beyond the firewall, outside the system.
The same system monitoring and protection tools that are currently used to counter outside threats are needed inside the system. Such internal tools would help immensely in identifying illegal and inappropriate insider activity. A large amount of statistics about individual cyber attacks is required in order to be able to recognize that an organized, concerted attack from foreign country is underway. Information about an individual attack generally can not provide an adequate amount of information to establish such a situation, especially given the weaving path through many telecommunication switches across national boundaries often followed by current hackers to avoid detection. Frequently the victims of cyber attacks, especially companies concerned about public trust in them and their operations, are not willing to share the information necessary to put together such statistics.