The most critical factor to consider is to limit the access granted to an individual to only what is required for his/her job duties. The other options are not as critical. Insider attacks may be initiated by employees, consultants and/or contractors of an organization. Insider-related risk is the most difficult risk to defend against because insiders typically have been granted some physical and logical access to systems, applications and networks. Remote access to corporate networks and data also is common, due to technology such as virtual private networks (VPNs) and smartphones, and poses a great threat to corporate data. There is a need to put into place strong and effective controls to mitigate this risk, the most basic of which is limiting access to what users need to do their jobs.