Even as DDoS attacks against everything from large financial institutions to online gaming companies continually hit the news, most organizations still underestimate not only the rising threat but the steps necessary for mitigating it.

When it comes to threats to steal your company’s intellectual property—the trade secrets that make your business successful—internal employees you know and implicitly trust can inflict far more damage than any Chinese attacker, Russian mafia cartel or Anonymous-based hacker. But unlike those attackers, insider threats are far more difficult to identify and prevent, unless you know and continually watch for the signs.

Here at IANS, we see the vast majority of our CISO clients seeking to employ a governance, risk and compliance (GRC) model, dutifully trying to deploy their capital and employ their people in a way that addresses some of the biggest risks to their business. But, here’s the problem: GRC is, in theory, the right way to go, but no one knows the steps—how to actually implement GRC in practice inside a large enterprise.

What are the main security threats facing IANS clients in 2013? In a recent webinar, IANS faculty members Kevin Johnson, Diana Kelley and Dave Shackleford outlined what they see as the most pressing areas of concern, ranging from the web to mobile, to virtualization, the cloud, and more.

What about the counter-intelligence route? Back in the early days of internet security there were companies that bragged that they had spies in the hacker community who would keep them abreast of what was going on. And today we have journalists like Brian Krebs, who try to ingratiate themselves within some of the hacker community(ies) to learn where they’re going and what they’re doing, next. I know another security practitioner whose hobby is maintaining multiple “sock puppet” personas that are members of certain well-known hacking groups. In principle this sounds like it could be interesting, as well as fun, but in practice I’m dubious about its benefits.