ABSTRACT
This chapter describes the in-trust security measures (also known as aftercare or ongoing security) that can be applied after a person has been trusted with access to an organisation’s assets. Most insiders become insiders after they join their organisation, which means that in-trust measures must do much of the heavy lifting for personnel security. The main categories of in-trust measures are: access controls; exit controls (e.g. data loss prevention); behavioural controls; awareness-raising, training, and communication; reporting channels and management oversight; automated monitoring; investigation; sanctions (e.g. disciplinary measures); and exit procedures. Automated detection and monitoring technologies have much to offer, but their performance often falls short of expectations, and they raise important issues of intrusion and privacy. At worst, they can exacerbate the risk.
