Behavioral and policy issues in information systems security: the insider threat

(2009) 18, 101–105. doi:10.1057/ejis.2009.12 Modern global economic and political conditions, technological infrastructure, and socio-cultural developments all contribute to an increasingly turbulent and dynamic environment for organizations, which maintain information systems (IS) for use in business, government, and other domains. As our institutions (economic, political, military, legal, social) become increasingly global and inter-connected; as we rely more on automated control systems to provide us with energy and services; and as we establish internet-based mechanisms for coordinating this global interaction, we introduce greater vulnerability to our systems and processes. This increased dependence on cyberspace also inflates our vulnerability – isolation is no longer an option. Perhaps no aspect of this phenomenon is as alarming and challenging as the need to understand and address the various risks to the security of the IS on which we depend. Security risks arise from multiple sources and motivations. In a taxonomy developed by Loch, et al. (1992), threats to IS security were categorized into four dimensions – those that are external (both human and non-human) and those that are internal (human and non-human). The research focus of those in engineering and computer science is predominantly on the external threats, and a plethora of artifacts have been developed to protect the organization’s perimeter (e.g., intrusion detection systems, firewalls, anti-malware software, etc.). Within the MIS research tradition, there has been a significant effort to investigate human perpetrators of IS security threat, especially from those who are within the organization (behind the firewall, as it were). In the Loch, et al. (1992) framework, these sources of threat were further characterized by their intention (intentional vs accidental). Much of the focus within the behavioral research community has been on IS security policy noncompliance by employees. Such acts may be intention-based, willful, malicious violation (such as sabotage, data theft, data destruction, etc.) or they may be unintentional or accidental actions, including forgetting to change passwords, failing to log off before leaving a workstation, or careless discarding of sensitive information rather than shredding it. Warkentin (1995) expanded the taxonomy to include low-grade and high-grade threats; the latter being a purposeful individual or organization who will seek obscure vulnerabilities and inflict far greater economic damage by maintaining intrusions for the maximum long-term gain. So risks from intentional human activity are especially dangerous, especially in a world full of new, more sophisticated hackers, spies, terrorists, and criminal organizations which are committed to coordinated global attacks on our information assets in order to achieve their goals. Some malicious individuals wish to inflict damage and loss for political reasons or for military purposes, some are seeking ‘trade secrets’ and proprietary corporate information, and others are seeking financial information with which to conduct fraud, identity theft, and other criminal acts. Another category of risks has arisen from new classes of European Journal of Information Systems (2009) 18, 101–105 & 2009 Operational Research Society Ltd. All rights reserved 0960-085X/09