Bob Farber is the CEO of Symark. Prior to joining Symark, Mr. Farber was the Manager of Technical Support Operations for Candle Corporation. In this interview he discusses the growing problem of insider threat.

How has insider threat evolved in the past few years?

Insider threat has become more prevalent and sophisticated in recent years, thanks in large part to identity theft being such big business. According to the Identity Theft Resource Center (ITRC), as of April, 167 breaches were reported in U.S. so far in 2008, accounting for 8,391,871 exposed personal records. What’s more, according to the Computer Security Institute’s (CSI) 12th Annual Computer Crime and Survey from September 2007, insider threat was up by 17 percent. There is definitely a correlation between these figures:


Identity theft is often driven by international organized crime groups that solicit customer data and credit cardholder information via Internet chat rooms in exchange for large sums of money. These organized crime entities—which are beyond the reach of U.S. law—often contact “trusted” users within large organizations and ask them to access databases to obtain information that can be exploited. Ex-employees who are aware of lax security practices will “ping” accounts to see if they can still access or sell information about what an organization has—or has not—done to protect its vital data. Insiders have intimate details about the company’s efforts to protect proprietary systems and information, and they possess the skill set and knowledge required to exploit any existing gaps. All they need is a motive, which can be money, revenge or even just the chance to embarrass a current or former employer.

Two recent examples of insider threat (with very costly consequences) include the Société Générale fiasco and Tenet Healthcare incident. In January 2008, it was discovered that a Paris-based Société Générale trader committed fraud to the tune of $7.2 billion (with an additional loss of $50 million to cover forced short sale of assets). This trader previously held a position within the IT department and used the privileged access rights he was given in that role to create and conceal “dummy” accounts. In February 2008, a former Tenet Healthcare employee accessed the records of more than 37,000 patients and stole 90 identities before he was caught.