Insider Risk is an area that is commonly underestimated despite how common it is. Here is some survey data on the topic: ca.com/content/dam/ca…
There are lot's of ways to mitigate risk but one thing is for sure, you can not manage what you can not measure. For this reason, designing your systems in such a way they are transparent is one of the more impactful things you can do to address these risks.
One interesting side effect of building the transparency into a system is that its existence disincentivizes actors from abusing their position. Afterall if you do something wrong and you are sure to get caught your less likely to do so in the first place.
When you take the transparency to the next step ensuring that it minimizes trust and is independently auditable and reliable by all parties in your ecosystem you raise the bar even further.
Building on top of that when you make the system self-enforcing, only functioning when the auditing has taken place, you not only disincentivize the act in the first place you literally make it harder to do.
This approach considers the realities of the world we live in and considers the economic and personal interests to an attacker and raises their "cost" of an attack by both reducing the chance of the attack and making the chances of getting caught higher.
These are some of the reasons I like the concepts of Generalized Transparency that back Certificate Transparency, Key Transparency and the other applications of the github.com/google/trillian platform.
