4.1Human and physical controls

Stacking technical controls alone will not prevent insider fraud or human error. As IPA's Guidelines for Preventing Insider Fraud in Organizations point out, insider fraud occurs when "motive, opportunity, and rationalization" align. This section studies human and physical controls from the perspective of a security officer at a company who must decide how to combine measures to reduce the risk of insider fraud.

4.1.1Internal fraud prevention guideline and security education

• IPA's Guidelines for Preventing Insider Fraud in Organizations center on "denying opportunity" and "breaking the fraud triangle (motive, opportunity, rationalization)," calling for multifaceted measures spanning asset management, access control, physical management, personnel management, and compliance. They work only in combination with organizational operating rules, not technical controls alone.
• Security education and drills include targeted-email training (sending simulated attack emails and measuring open/report rates to raise awareness) and red team exercises, in which a simulated attacker team tries to slip past the organization's defenses to test the defending blue team's real-world response capability in a practical, hands-on way that classroom training cannot provide.

4.1.2Need-to-know and privileged access management

• Need-to-know (principle of least privilege) grants information and authority only to those who need it for their job, and only to the extent needed. It is the most fundamental way to structurally reduce the "opportunity" for insider fraud, and is effective only when paired with prompt revocation of access upon transfer or departure.
• Privileged access management (PAM) separates high-privilege accounts, such as system administrator accounts, from ordinary business accounts, and permits their use only through a request-approval workflow, time-limited grants, and session recording. Preventing the abuse, sharing, or always-on login of administrator accounts is why PAM is emphasized as an insider-fraud countermeasure.

4.1.3Log management and entry/exit control

• Log management retains access logs, operation logs, and authentication logs for a set period and reviews them regularly. It works both as a deterrent (the awareness of being monitored) and as a means of post-incident tracing and evidence preservation. Tamper prevention—forwarding logs to a separate server, storing them on WORM media—is also required.
• Entry/exit control uses IC cards or biometrics to control physical access to server rooms and similar spaces. Anti-passback denies exit for a person with no entry record (or re-entry for a person with no exit record), detecting and deterring card lending and tailgating (multiple people passing on a single authentication). An interlock is a double-door mechanism where one door cannot be unlocked while the other is open, making tailgating itself physically difficult.

Suppose a data-center operator is concerned about the risk that an administrator planning to resign might maliciously exfiltrate customer data. First, from a need-to-know standpoint, as soon as the administrator signals intent to resign, unneeded privileges should be promptly revoked, narrowing access to the bare minimum required for remaining duties. If privileged access management is in place, administrator privileges already require per-use request and approval with session recording, so any suspicious bulk access can be caught immediately through log management review. Entry/exit to the server room should enforce anti-passback so the administrator cannot re-enter without an exit record, and a double-door interlock prevents a third party from tailgating in as well. The key point is that no single measure alone is sufficient—need-to-know alone cannot stop illicit copying within an already-authorized session; log management alone enables post-incident tracing but not prevention; and physical controls alone cannot stop wrongdoing by an insider who legitimately holds the access. Only by combining human controls that reduce "opportunity" (need-to-know, PAM) with log and physical controls that provide "detection and deterrence" does the multilayered check intended by the internal-fraud-prevention guideline actually function. On top of this, clear desk / clear screen rules (locking away documents and locking the screen when leaving a desk) and ongoing targeted-email drills that raise security awareness further reduce the room for motive and rationalization.

4.1.4RASIS

• RASIS stands for five metrics of system trustworthiness: Reliability (resistance to failure, MTBF), Availability (uptime rate), Serviceability (ease of recovery from failure, MTTR), Integrity (data is not destroyed or tampered with), and Security (protection from unauthorized access).
• Security measures contribute most directly to Integrity and Security among the five, but a physical incident caused by weak entry/exit control can also undermine Availability—the practical evaluation lens is that the five elements are not independent but interact with one another.

4.1.5Section summary

• Insider fraud occurs when motive, opportunity, and rationalization align. Need-to-know and privileged access management structurally reduce "opportunity"
• Log management provides detection and tracing; anti-passback/interlock physically prevent tailgating—combination, not any single control, is the premise
• The five RASIS elements (Reliability/Availability/Serviceability/Integrity/Security) interact with one another