SOFIT: Sociotechnical and Organizational Factors for Insider Threat

Human behavioral factors have been insufficiently represented in structured models (e.g., ontology frameworks) of insider threat risk. This paper describes the design and development of a structured model that emphasizes individual and organizational sociotechnical factors while incorporating technical indicators from previous work. We compare this model with previous research and describe a use case to demonstrate how the model can be applied as an ontology. We also summarize results of an expert knowledge elicitation study to reveal relationships among indicators and to examine several quantitative models for assessing threat of cases comprising multiple indicators.