IDG News Service — State government CIOs need to be more aware of insider threats to their networks, including lost laptops and malicious actions by disgruntled employees, according to a national group of state CIOs.

Insider threats, including inattentive, complacent or untrained employees, as well as security lapses by contractors or outsourcing companies, represent the most important risks facing state IT networks, according to the National Association of State Chief Information Officers (NASCIO) in a report released last week. (See the report here.)

NASCIO also warned state governments about insufficient IT security compliance and oversight and about data on mobile devices.

NASCIO released the report to remind state CIOs that high-profile hacker cases shouldn't be their only focus, said Brenda Decker, CIO for Nebraska's state government and co-chairwoman of NASCIO's privacy and security committee.

"As you focus on those big things, you have a tendency to forget about the things that are happening right within your organization," Decker said. "My biggest fear is that people don't even understand that this is happening."

The report came out of NASCIO's conversations with state CIOs, many of whom identified outsider threats as a major concern, Decker said. But large data breaches, caused by lost hardware at the U.S. Department of Veterans Affairs and other government agencies in the past year, have raised the profile of insider threats, she said.

In addition, state employees' ability to do more work on mobile devices has raised concerns, she said.

"We've tried to make it very easy for our employees to work on the move," she said. "You've got more computing power on your hip these days than we would have ever imagined 10 years ago."

The report cites a study of compromised data incidents published in the Journal of Computer Mediated Communication earlier this year. In 2006, about 80 percent of publicized data breaches came from organizational threats instead of outside threats, and in 2005, more than half were attributed to insider threats.

The report makes a number of recommendations for dealing with insider threats, including employee training about cybersecurity, and "swift and severe" consequences for malicious employees.

Several states have good employee training programs and others, including Nebraska, are working on them, Decker said. "We're getting there," she added.