I do wish we’d stop referring to people who make a mistake (click on a link/ don’t challenge a tailgater etc) as “an insider threat” - that’s not what the term originally referred to and actually it means anyone capable of a mistake is an insider threat. So that’s me, you, the intern, the ceo. - ThreadSky

lisaforte.bsky.social • 41 days ago

I do wish we’d stop referring to people who make a mistake (click on a link/ don’t challenge a tailgater etc) as “an insider threat” - that’s not what the term originally referred to and actually it means anyone capable of a mistake is an insider threat. So that’s me, you, the intern, the ceo.

Comments

ag100pct.bsky.social•41 days ago

I am going to make an "IT Clue" game or Clue - IT Version.
Instead of the usual cast...it's the Intern, CEO, etc.
Could be Great fun...and a great gift.

lisaforte.bsky.social•41 days ago

Yes you can go down this road of labelling your employees as insiders the moment they make a mistake but 1) that says dreadful things about your culture and 2) actually studies show you are more likely to create genuine insiders when people don’t feel valued and supported.

So yes, language matters

my-random-name.bsky.social•41 days ago

Insider threat
vs
Insider oops
vs
Insider did not follow protocols

3 different categories
3 different sets of requirements

amias.net•41 days ago

Never ascribe to malice that which can easily be explained by incompetence.

Also applies to incontinence, especially in the continent

quentyn.bsky.social•41 days ago

For me insider threat has to have an element of malfeasance - else it's just a mistake

lisaforte.bsky.social•41 days ago

Exactly. That’s my position too

profdanny.bsky.social•41 days ago

There's no such thing as human error...it's just people being human... 🙈

cerb20.bsky.social•41 days ago

Insider threat is someone who deliberately makes things worse for security. I would never call the average employee an insider threat. A security risk would likely be a better term, but then again, it's our job as the security teams to make sure nothing happens, if they accidentally click a bad link

cyberphilosohack.bsky.social•41 days ago

Building a no blame culture is something I do. It is actually really quite hard and interesting. The phy of it all

cyberphilosohack.bsky.social•41 days ago

And when I say phy I mean psy

miketalonnyc.bsky.social•41 days ago

It's more "internal risk" and it's omnipresent - it doesn't happen when the user clicks something, it's always there.

lisaforte.bsky.social•41 days ago

And ultimately language matters. You make a mistake - we are all at risk of doing that - and now you’re an “insider threat” - yeah that’s not really encouraging people to engage with security is it

tk1ng.bsky.social•41 days ago

Insider threat might be a bit harsh; threat implies intention.

The language is interesting. Is a mistake just a mistake if it's based on an unwillingness to address persistent ignorance? If someone operated a motor vehicle ignorantly and had a collision, who is to blame?

https://youtu.be/puK5CwThaq4?si=CGS840WS9slgK0Lj

lisaforte.bsky.social•41 days ago

Well I’d argue that’s either negligence or recklessness

tk1ng.bsky.social•41 days ago

Agreed. It's not an accident/mistake if a breach is caused by negligence or recklessness either; the user bears (some) responsibility.

But you're right, it's not an 'insider threat'. It's not only a 'mistake' either.

As an educator I have to believe we can fix the underlying education problem.

syfuhs.net•41 days ago

Describing execs as insider threats does have a certain appeal, I'll admit.

Comments

Posting Rules

Reply