Threats come from inside through employees or vendors, and from the outside through hackers or infected websites. Both types of threats should be considered and policies and procedures developed for each threat. James Antonakos of the National Cybersecurity Institute explains.