Positioning Your Organization to Respond to Insider Threats

Insider threats refer to actions by trusted individuals that directly or indirectly bring harm to the organization or expose the organization to external risks. Insider threat detection research and mitigation approaches have over-relied on technical solutions that tend to miss the human behavioral aspects of the problem. This paper focuses on approaches to assemble knowledge about insider threats and to apply this knowledge in support of insider threat assessment. This information can help organizations set up or improve existing insider threat mitigation programs by promoting a greater understanding of insider threat variables of concern; facilitating sharing of the knowledge base of insider threat indicators across organizations; raising awareness of the need to examine behavioral factors in addition to the more traditional focus on technical indicators; and discussing methods and challenges in acquiring and applying expert knowledge of insider threat indicators to facilitate decisions about responding to threat assessment alerts.