@CISOScott wrote:
My disagreement is with the use of the word threat. I view insider threat as usually having malicious intent. Maybe that is just my work in the intelligence field creating my bias. uses them to do some more research into what they were wanting to do.
Kenneth's interpretation of the word threat, along with subsequent comments in this thread, illustrate an issue we see repeatedly in INFOSEC: tight definitions of key words must always be provided in the context of usage.
For those of us who have worked in the area of risk management, threat is used without any pejorative implication of motivation or intent. The best example can be found in continuity of operations planning (COOP) and business continuity planning (BCP). Major weather events such as thunderstorms, tornadoes, hurricanes, and floods are all threats, but none of those events are malicious. They just are.
The potential for misunderstanding the use of the term threat as illustrated here is why my risk taxonomy separates concepts into two terms: threat and threat actor. Phishing e-mails are threats. People who intentionally send phishing mails are threat actors. My best real world story on contextual definitions is when two mid-level managers got into a screaming match when they actually agreed with each other on firewall traffic policies. One was thinking of the TCP/IP stack definition of protocol, and the other was considering protocol in the looser usage in naming of such as ftp and http.
To further extend this definition of threat we need to address a specific insider threat concept, that of malicious and non-malicious intentional acts by insiders, the subject of my dissertation research. We know that users will intentionally violate selected security rules with no malicious intent, when doing so assists them in getting their primary jobs done. You can see me pontificate on this aspect in my 25 minute presentation, "Why don't they follow the rules? Maybe its the boss's fault!"
.
Craig
