It was former National Security Agency contractor Edward Snowden who brought the risks of malicious insiders to international attention in 2013, but the danger to enterprises can be just as great from loyal insiders who are simply "clueless or careless," and fall for social engineering scams.
Joseph Loomis, founder and CEO of CyberSponse, said he is, "sure there are major companies out there with little controls over their employees and their access rights. Who is watching who and what they're doing?"
It is also about employees controlling themselves when presented with ever-more persuasive social engineering attacks.
The federal government reported earlier this year that 63 percent of the breaches of its systems in 2013 were due to human error.
According to Marciano, "employee negligence was at an all-time high in 2014," with the problems ranging from, "failure to perform routine security procedures to lack of security awareness, routine mistakes and misconduct."
Eldon Sprickerhoff, cofounder and chief security strategist at eSentire, noted that, "phishing emails are getting better and better. I've seen some that were so well targeted, so well done that I could not tell the difference."
And it is not just the average worker who is a problem. Identity Finder CEO Todd Feinman said the problem goes all the way to the top. "Many executives don't know where their sensitive data is so they don't know how to protect it," he said.
While BYOD is now mainstream in the workplace, Isaacs calls the increased focus on mobile computing, "very scary, and it's going to get even worse."
BYOD is now bringing, "extremely unreliable business applications inside the walls of corporations," she said. "There are a lot of software vulnerabilities. Every app that is free or 99 cents, probably doesn't have great level of security. And people don't install patches either."
According to Clyde, "there are now many times more mobile devices than PCs in the world. In fact, in many regions of the world, mobile devices are the only way most users connect to the Internet," yet security remains a relative afterthought.
ISACA found that, "fewer than half (45%) have changed an online password or PIN code.
And now, connected wearable devices (BYOW) are becoming common in the workplace, yet, "a majority of professionals say their BYOD policy does not address wearable tech, and some do not even have a BYOD policy," Clyde said.
The age of Incident Response (IR)
All of the above issues have led to an increased focus on IR. According to Schneier, this is not just the year but the decade of IR, following a decade of protection products and another of detection products.
Sign up for Computerworld eNewsletters.