Using Automated Identity and Access Management Controls

Protecting a Network Against Insider Attacks

George R. Aldhizer, PhD, CPA, CIA, CFE, and Paul E. Juras, PhD, CPA, CMA, and Dale R. Martin, DBA

Over the past few years, information technology (IT) audit and security managers have embraced e-commerce and focused their resources on installing network-level automated controls. The purpose of these controls is to help protect against outside attacks from hackers and competitors. Network-level automated controls may include firewalls, intrusion-prevention software (e.g., antivirus software), intrusion-detection software, and “demilitarized” zones (DMZs). The greater threat, however, may come from within an organization. It is estimated that 69% of database attacks originate with insiders (“Global State of Information Security Study 2007,” PricewaterhouseCoopers, CIO, and CSO, August 2007).