Conclusion

Insider attacks, like any computer incident, have the potential to be business crippling. Senior management must be involved with the investigation and needs to make those business decisions (such as whether to terminate or prosecute ) that will guide the investigation process while preserving the end goal of helping the business respond to the attack.

As previously discussed, insider attacks are especially challenging for an incident response team. The attackers might know of the investigation (and, even worse , might actually be part of the team). They have access to the most sensitive systems and data in the company, and they are in a position to exploit that data. The incident response process should contain procedures for detecting and investigating insider attacks, including, when appropriate, the specific criteria for requesting external assistance.