According to statistics, insider threats pose the most potential for damage to data and network infrastructure. Do you agree? Or would you say the threat is external? What policies and procedures would you put into place to protect against these threats?