You can't completely control what you allow, and you allow users to have access. A level of trust is inherent when you grant access. There are steps you can take that will make it much more difficult for an internal user to cause damage, lessen the amount of damage they can cause, and increase the likelihood that you can recover from what damage does occur. Doing so requires a comprehensive process of security. Security is not a product, nor is it a technology.
Security is a process.
The process of security consists of many things, including policy, procedure and training. It contains preventative control measures and a healthy dose of awareness. It includes disaster recovery and business continuity. Various products and technologies support all of these elements of the process. The process of security is a state of mind that must permeate a corporation and its culture to be effective.