Front cover - IBM Redbooks

In our discussion, risk has all of these meanings. It is the possibility of suffering
harm (definition 1); the factor or thing presenting danger, the hazard (definition
2); and also the exposure to the possibility of loss or damage (definition 3).
For an IT department, risk is the danger or probability of loss of reputation,
sensitive information, or the ability to continue doing business. It is also the
quantity of each, including sums of money related to those that a company
stands to lose.
A comprehensive portion of your security policy deals with the manner in which
you manage the risks faced by your company's computer system.
Often, companies and their IT personnel do not understand the nature of those
risks. With all the hype in the media (both printed and electronic), they assume
that the real danger comes from the Internet and from people outside of the
company.
After all, the portrait that is constantly painted of these individuals is that they are
poorly dressed Generation X'ers who have nothing better to do in life than to
scour the Internet trying to find vulnerable systems to attack, penetrate, and
maliciously destroy or corrupt. A prime example of this characterization can be
found in Clifford Stohl's excellent, and totally true, novel The Cuckoo's Egg:
Tracking a Spy Through the Maze of Computer Espionage (Mass Market
Paperback Reprint edition, July 1995, Pocket Books, ISBN: 0671726889). In this
story, the cracker in question is young, wears jeans, and wreaks havoc left and
right, using the computer systems of one company as the springboard to attack
the systems of other companies and organizations.
Therefore, upper-level managers at various companies believe that if they
properly secure their computer system from people on the outside of the
company and shield access from the Internet, they have effectively secured their
computer system, at which point they can cease the work of hardening and
securing the system and finally sleep soundly at night.
Bad news: this view of the computer security world is incorrect and shortsighted
at the same time. The sad reality is that many companies have suffered and died
from attacks perpetrated by insiders, meaning people working for the company.
These are usually attacks by disgruntled employees who use the newly acquired
information to their advantage.
You should therefore make sure that your computer security policy includes the
necessary safeguards to protect information from people on both sides of the
virtual security fence.
Chapter 2. Security methodologies 45