Towards a New Insider Threat Mitigation Framework

Insider threat agents have become a major concern for any organization. This research establishes the limitations of the traditional MOC (Motivation, Opportunity, and Capability) theory relied upon in cybersecurity to mitigate insider threats. Such limitations are supported by the ever-increasing sophistication and complexity of the characterization of insider threat landscape. We thus relied on studies undertaken in fraud theory to demonstrate that an element of Rationalization can be augmented to the MOC theory without loss of generality, paving the way therefore for the conceptualization of a new Insider Threat Mitigation Framework of which Rationalization becomes a significant determinant. This leads to a new cybersecurity theory, the MOCR theory. Our proposed MOCR theory states that a privileged user becomes a threat to an organization only when the four attributes are realized simultaneously to a variety of degrees by an insider. As such, the appropriate mitigation measure from an organization perspective is to dynamically ensure that, an insider keep their risk profile (MOCR profile) very low, at any given time, throughout their lifecycle in the organization. A fifth component, Influence (I) which has the effect of catalysing the attainment of MOCR was identified and its impact in attaining MOCR was discussed.