But taking some of that power and access away from IT employees can be a delicate procedure. In the CERT study, 92 percent of all of the insiders attacked their organizations following a negative work-related event, such as a dispute with a boss, a demotion or a transfer. “The people who have had privileged access have enjoyed the freedom to do whatever they wanted to do,” Kark says. “If you put in control where there was no control before, there’s going to be some resistance.”

Network Services Company’s Roche was “somewhat seriously concerned” about that kind of resistance when he instituted a new policy for how his IT staffers would monitor employees’ computers. Each IT staffer received a specific ID and password for tapping into systems for monitoring and “running a report” on an employee. Each monitoring event could be initiated only by HR, and every one would be logged. Roche credits the time he took to explain to everyone why he was instituting the policy and why it was important to the company for the fact that he didn’t get the pushback he anticipated. That, and the perception that “they wouldn’t want someone doing it to them.”

Kark says there are three key things that CIOs need to make certain (and communicate to their staffs) when rolling out these types of policies. First, make it clear who in IT has ownership and responsibility for each part of the process when any type of event is triggered by the HR, legal, physical security or compliance departments. Second, there needs to be a decision tree for how IT employees will respond to each incident and investigation, with a detailed analysis of different types of scenarios and the resulting procedures. And third, CIOs and their staffs should run simulations and tests on how the processes will play out when an event happens.

For all of Riel’s claims of whistle-blowing at Morgan Stanley, it was, ironically, one of Riel’s subordinates who followed the proper chain of command and blew the whistle on Riel.

Despite Morgan Stanley’s insistence that its procedures functioned properly, a lot of things went wrong. Of course, a lot of things can go wrong anywhere, but accepting that inevitability, and planning for how to handle it, is the key to good security and a lot less anxiety for CIOs. “We do everything we can to stay on top of this,” says Credit Suisse’s Sanzone.

“But sure, I worry.”

Senior Writer Thomas Wailgum can be reached at twailgum@cio.com.