Cyber Security and Information Systems Information Analysis Center
Insiders may have accounts giving them legitimate access to computer systems, with this access originally having been given to them to serve in the performance of their duties; these permissions could be abused to harm the organization. Insiders are often familiar with the organization's data and intellectual property as well as the methods that are in place to protect them. This makes it easier for the insider to circumvent any security controls of which they are aware. Physical proximity to data means that the insider does not need to hack into the organizational network through the outer perimeter by traversing firewalls; rather they are in the building already, often with direct access to the organization's internal network. Insider threats are harder to defend against than attacks from outsiders, since the insider already has legitimate access to the organization's information and assets.
According to the Center for Development of Security Excellence (CDSE), an insider threat is defined as “the likelihood, risk or potential that an insider will use his or her authorized access, wittingly or unwittingly, to do harm to the security of the United States or the organization.” Insider threats may include harm to contractor or program information to the extent that the information impacts the contractor or agency’s obligations to protect classified national security information.
Today, every organization is a target and attackers can compromise any organization. Large-scale compromises used to be a surprise, but now they are a reality that is often accepted. The means, methods and techniques that adversaries use to target and ultimately compromise organizations have caused a shift in mind-set. It is not a matter of if an attacker Read More
Today’s adversaries are advanced and more capable than ever before. Passive defensive tactics are no longer viable for pursuing these attackers. To compound the issue, the existence of an insider threat creates a challenging problem for the passive defender. One of the largest breaches of classified information was carried out by an insider. Months after the Read More
There are currently an estimated 4.9 billion embedded systems distributed worldwide. By 2020, that number is expected to have grown to 25 billion. Embedded system scan be found virtually everywhere, ranging from consumer products such as Smart TVs, Blu ray players, fridges, thermostats, smart phones, and many more household devices. They are also ubiquitous Read More
The Payment Card Industry published the Data Security Standard 11 years ago; however, criminals are still breaching companies and getting access to cardholder data. The number of security breaches in the past two years has increased considerably, even among the companies for which assessors deemed compliant. In this paper, the author conducts a detailed Read More
Researchers at Carnegie-Mellon University have created an “Insider Threat Ontology” as a framework for knowledge representation and sharing of malicious insider cases. The ontology features rich constructs regarding people who take malicious actions to compromise or exploit cyber assets. However, modeling end-user error was outside the scope of the CMU work. Read More
Building a quarterly journal that spans broad topical and technical themes can be challenging, and the selection of articles for any one journal intimidating. Over the last five years CSIAC has published special issues on military research laboratories (Volume 5 Number 1; Volume 4 Number 1), focused in on particular relevant technical thrusts (i.e., Serious Read More
Analyze. Deter. Discover. Prevent. Respond. This issue of the CSIAC Journal presents five articles which represent different perspectives on Insider Threat and approaches to understand and remediate that threat. In this journal we are proud to identify and include work by two organizations with a long history of research and good counsel regarding Read More
The mysterious foreign villains striking the largest companies and political organizations from the dark corners of the Internet tend to get the splashy headlines. However, the network openings that allow outside cyber-attackers to burrow in, infect databases, and potentially take down an organization's file servers overwhelmingly originate with trusted Read More
In recent years, a few specific threats have caused significant damage to targeted victims. Ransomware continues to plague numerous industries. Having up-to-date systems and backups are crucial in the defense against ransomware. Insider Threats also cause significant damage to unsuspecting organizations. Monitoring for unusual activity Read More
An insider threat is a malicious threat to an organization that comes from people within the organization. Learn how to spot some possible indicators of an insider threat. Learn some more about possible indicators for an Insider Threat by watching this related video: https://www.csiac.org/podcast/insider-threat/ Read More
