Anybody else see a slight flaw in books, teachers, or lectures always preaching that the Insider is the biggest threat to a computer network without adding any kind of background or caveats to the statement.

This type of statement has become law in the security community, but I feel its slightly misleading to the uneducated. The insider is only the biggest threat because security has been applied to the perimeter in a massively disproportional amount to whats applied internally. Security is often not as rigourous on the inside because it often impedes a companies business operations. Its much easier for companies to dump millions on firewalls and VPNs, then to spend much less on systems that your going to buy anyway with better access control. Its also much cheaper to enforce stricter policies on its users, but it will still come at the cost of potentially slowing down the business. For instance compare the cost of buying a brand new pair of enterprise class firewalls to the cost of buying more drive space for retention and aggregation of logs or turning up a tighter password policy on your network. I think the simple fact of the matter is that, if companies spent more money on internal controls and small amounts on perimeter controls, we would have a different story. Which is the bigger threat, unrestricted access for any an all outsiders or unrestricted access to employees?

Internal controls do get the shaft. But assuming that you have the basic external defenses against outsiders, the internals are the bigger threat because they generally have some knowledge of where the goodies are at and how poorly protected they are. They are also, of course, inside your external defenses already, and when their activity shows up in some logs, they are sometimes passed over as legit.

Think about fraud, which is basically all internal. Much of it occurs due to poor security, whether it be controls or lack of log and system review. I think too many pros focus on stopping the real cool "hacks" and ignore the fraud, which costs companies serious money and go undetected, on average, for 18 months.

In my last company, I assisted with 2 fraud cases that went 9+ years. That's bad controls and review practices.

When I think of external fraud, I think of customers trying to cheat the company with false claims and the like; in my mind, it doesn't include system access.

When I think of internal fraud, I think of internal folks accessing and manipulating systems in ways they should not be able to.

It depends on your industry.

Any more thoughts, Ole?