Two posts in a day. It’s like the fires of blogging have been rekindled.

(Not really)

Some Twittering going on about protecting against insider threats in lieu of what happened with Code Spaces, but that was an external threat made manifest so I don’t see the technical equivalence.

I do however see the dread risk fear that such an event has on people.

Evolution has programmed us to react to dread risk fears to somewhat irrational levels as we see them all as extinction threats. You might fear the aircraft you’re flying in going down, but the most dangerous part of your trip was the car ride to the airport where many more people are killed on the roads in accidents every year than they are flying on a plane. 

An entire company reduced to rubble by an extortionist. What if it happened to us!?! People aren’t too worried that users and operators make a litany of errors throughout the year, all of which add up when it comes to data loss and data leakage, but it’s terrifying when the catastrophe happens all at once.

Considering Enterprise IT tends to drive with the handbrake on when it comes to the adoption and provisioning of new services, thereby feeding into the ‘IT is broken as it takes you days to do anything, Cloud is faster & better’ chorus, if you want to get any work done at all the last thing you should be doing is throwing more obstacles in the way of insiders getting their work done.

The thinking that things should be slowed down even more to protect against the phantom insider, someone willing to lose their career and go to prison if they carried out such a malicious act, will do nothing but drive even more slipshod processes out onto the public cloud where the only experience you need at running an IT operation is in entering your credit card details.

So lock your doors and windows, and put out the cat. Secure your data but be sensible around getting work done, then take the time to hire good solid people who you trust to protect it.

And keep the dread risk fear in check.