Insider Threats

By far the greatest threat to information systems in terms of computer crime comes from employees inside an organisation. It is not uncommon for operators, media librarians, hardware technicians and other staff members to find themselves in positions of extraordinary privilege in relation to the key functions and assets of their organisations. A consequence of this situation is the probability that such individuals are frequently exposed to temptation.

A further complication is the tendency on the part of management to tolerate less stringent supervisory controls over information system personnel, often allocating them to contractors or other third parties.

The premise is that the work is not only highly technical and specialized but difficult to understand and control. As an example, systems or applications software support is often entrusted to a single programmer who generates the version of the operating system or application in use, establishes password or other control lists, and determines the logging and accounting features to be used.

In addition, such personnel are often permitted, and sometimes encouraged, to perform these duties during non-prime shift periods or other times when demands on computer time are light. As a result, many of the most critical software development and maintenance functions are performed in an unsupervised environment. It is also clear that operators, librarians, and technicians often enjoy a degree of freedom quite different from that which would be considered normal in a more traditional employment area.

Insiders typically are aware of the "holes" in the system of internal controls and often exploit weaknesses "just to see if they can get away with it." The most prevalent method of committing computer fraud probably is alteration or falsification of input transactions (and/or documents), including:

·         Alteration of input;

·         Alteration of output;

·         Communications systems;

·         Computer operations;

·         Data file manipulation;

·         Operating systems.