6.9 Organizational Splitting

What it is

Organizational splitting occurs when organizations unconsciously divide security threats into oversimplified 'trusted internal' versus 'dangerous external' categories. This binary thinking creates dangerous blind spots by over-trusting insiders and systems while projecting all risk onto external attackers. Organizations experiencing splitting exhibit extreme trust in certain actors (long-term employees, vendors, executives) while attributing security failures exclusively to sophisticated external threats, making them vulnerable to insider attacks and social engineering.

Why it happens

Klein's Object Relations Theory (1946) identifies splitting as primitive defense mechanism where ego cannot tolerate ambivalence about objects that are both good and bad. In organizational contexts, this translates to inability to hold anxiety-provoking reality that trusted insiders can pose security risks. Bion (1961) demonstrated how groups under anxiety adopt basic assumptions that distort reality. Modern neuroscience supports Klein's observations with amygdala activation creating rapid categorization of stimuli as threatening or safe, with stress increasing brain's tendency toward binary categorization.

How it is assessed

A quick assessment asks these questions; each answer is scored from resilient to exposed.

Incident Root Cause Attribution Process
When your organization experiences a security incident or breach, what is your standard process for determining the root cause? Tell us about a specific recent incident and how the investigation concluded.
Privileged User Activity Monitoring
How often does your organization actively monitor the activities of privileged users (administrators, executives, long-term employees) for potential security risks? What specific monitoring tools or processes are in place for internal personnel?
Security Policy Exception Management
What is your procedure when senior executives, long-term employees, or trusted vendors request exceptions to standard security policies? Give us a recent example of such a request and how it was handled.
Access Control Consistency
How does your organization determine access levels for different personnel categories (executives, IT staff, regular employees, contractors, vendors)? Tell us about your specific process and any differences in security requirements between these groups.
Insider Threat Investment Balance
What percentage of your security budget is allocated to external threat detection (firewalls, perimeter security) versus internal threat monitoring (user behavior analytics, insider threat detection)? Provide specific budget breakdowns.
Trusted Vendor Security Reassessment
How frequently does your organization reassess the security practices of long-term, trusted vendors or partners? Give us an example of when you last changed security requirements for an established vendor relationship.
Zero Trust Implementation Coverage
To what extent has your organization implemented zero trust security principles (verify every user and device, regardless of location or perceived trust level)? Tell us specifically which systems or personnel are exempt from verification requirements and why.

Reading the result

Resilient

Balanced trust assessment with comprehensive incident investigation including internal factors, active monitoring of all privileged users regardless of role, security policies applied uniformly with minimal exceptions, balanced security budget allocation with minimum 30% focused on insider threat detection.

Partly exposed

Moderate splitting indicators with most incidents investigated but some automatic external attribution, privileged user monitoring exists but with gaps for certain trusted categories, security policy exceptions granted regularly with some oversight, different security standards for different personnel tiers.

Exposed

High splitting vulnerability with incidents consistently attributed to external attackers without internal investigation, minimal monitoring of privileged users especially executives, frequent policy exceptions for trusted personnel, significantly different security standards based on perceived trust levels.

What to change

Behavioral Analytics Implementation

Deploy user and entity behavior analytics (UEBA) systems that monitor all personnel activities regardless of role or tenure

Implement baseline behavior modeling for privileged users, automated anomaly detection for unusual access patterns, and risk scoring for all internal actors. Establish clear escalation procedures for behavioral anomalies regardless of user status. Include executives, administrators, and long-term employees in comprehensive monitoring scope.

Effort: high | Time to put in place: 60-90 days

Zero Trust Architecture Deployment

Implement comprehensive zero trust principles requiring verification for all users and devices regardless of perceived trust level

Deploy multi-factor authentication for all system access, micro-segmentation of network resources, and continuous authentication for sensitive operations. Eliminate security policy exceptions based on role or tenure. Implement least privilege access controls uniformly across all user categories.

Effort: high | Time to put in place: 90-120 days

Insider Threat Program Development

Establish formal insider threat program with dedicated personnel and resources

Implement psychological evaluation for high-risk positions, regular security awareness training focused on insider risks, peer reporting mechanisms for concerning behaviors, and structured investigation processes for internal incidents. Create cross-functional insider threat working group.

Effort: medium | Time to put in place: 45-60 days

Incident Response Process Enhancement

Revise incident response procedures to mandate comprehensive investigation of all security events including internal factors

Implement structured root cause analysis requiring examination of both external attack vectors and internal vulnerabilities. Establish independent incident review processes to prevent attribution bias. Create incident investigation templates ensuring balanced analysis.

Effort: medium | Time to put in place: 30-45 days

Access Control Matrix Standardization

Develop standardized access control matrices applying consistent security requirements across all personnel categories

Implement regular access reviews for all privileged accounts, automated provisioning and deprovisioning processes, and documented justification requirements for any access exceptions. Establish role-based access controls with principle of least privilege applied uniformly.

Effort: medium | Time to put in place: 45-60 days

Vendor Risk Management Program

Create comprehensive vendor risk management program with regular security assessments of all partners regardless of relationship duration

Implement continuous monitoring of vendor security postures, contractual security requirements for all vendors, and incident response coordination procedures. Establish vendor access controls with time-limited permissions and regular reassessment cycles.

Organizational Splitting