Doesn't really matter whether you are in-house or outsourced IT, a well placed rogue employee can equally screw you from within. I know I used to work in the DWP IT development agency, and it was very hard to control absolutely every thing, especially as they allow greater public access to their systems.
It was staggering for a highly vetted workforce. the number of times staff tried to access prohibited personal data and set off the alarm bells . .Issues are created by allowing staff to access their personal IT equipment or emails sent in from outside that carry viruses etc, despite all the fire walls and agreed procedures and practices in place. We had one instance of an internally generated virus hidden in header of a senior managers email which ensured wider circulation, that caused a few problems.
No firewall can keep everything at bay, and criminal gangs will recruit staff to do their dirty work from within.
