In addition to the “not helpfulness” that Gary pointed out – those numbers, like any global/national/industry level statistic have meaning only in context. A specific entity (business, gov’t, etc…) will actually find the past 10 years of history a more meaningful metric, defined by what an insider incident *is* in their context.

It’s kind of like trying to tie your budget to an industry norm. Who gives a rip what the rest of the industry is spending? Your spending has to be in the context of management’s tolerance for risk.

Such numbers are really not helpful. Even if it were supported by some evidence, the proportion of insider vs outsider attacks is also not very helpful. This is apples vs pears. Insiders, in the main, hold trusted positions with wide and deep access to systems, knowledge of values etc. They can observe and explore many systems, processes, network packets etc. without fear of being caught or sanctioned. They can commit their frauds and other attacks over an extended period, choosing their opportunities carefully. Outsiders have less knowledge of the specific internal configs, systems, apps, processes, data sets etc., greater technical barriers to exploring and compromising them, fewer opportunities to penetrate/exploit and (arguably) more chance of being caught at least at the perimeter. Some of them may have greater motivation and skills than insiders, but not all. For the organization, internal incidents such as staff frauds may be very costly but are less likely to be disclosed publicly, limiting the reputational damage. Outsider frauds etc. are probably more likely to end in disclosure and prosecution, hence perhaps reputational damage.

G.

I’ve been an infosec professional for over a decade and while I am sure I have not seen all the insider (or outsider) incidents that occurred on my watch, the number of occurrences and ratio of outsider to insider attacks suggests numbers in the 70% and above range are wildly overstated.

To me a figure like 96% suggests a large population of a company are in the midst of a massive pillaging of its assets somehow unbeknownst to the hapless infosec pro or the other four honest people left in the company

The last few years, outsider attacks have become more prevalent. It is easier to anonymously email malware than it is to infiltrate an organization or bribe someone I should think.

Whatever the case, to my mind, the key point for the infosec pro is to get a good handle on their company’s specific threats and risks because I guarantee that it varies from industry to industry, company to company.