Computer security experts devote their time and energy to the protection of sensitive data and the prevention of an outside attack on the internal network. They specialize in building secure firewalls as well as complex intrusion detection systems designed to keep intruders out. They watch and monitor the incoming message traffic very closely. But no matter how well they protect the private network from outside access without proper authority, they do not help prevent an attack by a malicious or disgruntled employee from the inside. And they cannot prevent breaches due to a simple lack of understanding of security policy by internal employees.
According to Kevin Mitnick, one of the world's best known hackers, "Companies spend millions of dollars on firewalls, encryption, and secure access devices, and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems" (Docherty, 2001).
What do YOU think of this statement?