Insider Threats: What Should You Protect?
In this brief presentation, the speaker defines insider risk broadly as any human who is either maliciously acting against the organization or unintentionally compromised. He argues that effective insider‑threat programs should concentrate on the truly nefarious insider—those acting with intent—because existing cyber controls and awareness training can mitigate the risks posed by unwitting employees. The core recommendation is to first identify the organization’s “crown jewels” – the most valuable data, assets, and facilities – and understand the business‑continuity impact if those were compromised or taken offline. By focusing monitoring and mitigation efforts on these high‑value targets, rather than attempting to reduce insider risk across every department, a program can be more efficient and aligned with business‑resilience goals. The speaker emphasizes that the answers to a robust insider‑threat strategy lie within a clear definition of crown jewels and an integrated business continuity plan.
