I can't comment as freely on this as I'd like, but here goes my best shot: The conventional wisdom that "insiders" make up the majority of threats has been cha

I can't comment as freely on this as I'd like, but here goes my best shot: The conventional wisdom that "insiders" make up the majority of threats has been challenged for a few years now. I know our sales people used to love touting about it to prospective clients, but what data exists (and it's far from perfect) doesn't seem to hold that up. In fact, the Verizon Data Breach Report for at least the last few years has shown the overwhelming number of attacks to be external. You can view it here: http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf http://www.verizonbusiness.com/resources/reports/rp_2010-dat... While that report isn't gospel (as an industry we still struggle with sharing data, even anonymized data), it's better than nothing. My own personal experience in the industry isn't helpful, as although a good 95% of the forensic cases I've worked were insider-issues, they are a self-selecting sample (clients decision to pursue a forensics investigation is in many cases dependent on if the attack was insider vs. outsider). Protecting from an internal threat is significantly more difficult than an external one, it's towards the top of Mazelow's Hierarchy when it comes to an organizations security posture. The most famous case I worked on involved a group of accountants who embezzled around 10 million dollars from their company, which they were able to do by having one individual make the transaction and the other approve it (because the client has implemented a system which required stock purchases to be audited by an outside group). Trust is a prickly thing, your internal security controls can only do so much. I've spent the last ten years breaking web applications for customers, and the general expectation has been to work from the position of an outside attacker. That's what the client is generally worried about. Whether that's logical is up for debate, but it's been my experience.