Nicholas B. Harrell, Alexander Master, J. Eric Dietz

CERIAS TR 2023-7

article

Insider threats are among the most costly and prevalent cybersecurity incidents. Modern organizations lack an effective way to detect and deter insider threat events; traditional mitigation approaches that focus on recruitment processes and workplace behavior have proven insufficient. Current analytic detection tools do not map technical indicators to organizational policies. This limitation results in poor risk calculations, rendering inaccurate risk mitigation decisions regarding insider threats. This paper proposes a pragmatic, data-driven approach that uses policy-mapped technical indicators to assess insider threat risk. Our approach provides a quantitative insider threat risk score to facilitate informed decision-making by policymakers. Using computer simulation modeling and synthetic data to iterate common threat scenarios, we increase the probability of detecting an insider threat event. This novel approach provides quantitative analysis with distinct advantages over qualitative risk matrices commonly used in industry to forecast and assess organizational risk.

PDF

2023 – 6 – 26

West Lafayette, IN, USA

Purdue University

Purdue Military Research Institute Defense & Security Research Symposium

Harrell

Purdue Military Research Institute

47-55

Purdue Military Research Institute Defense & Security Research Symposium

1

Purdue University, Army Cyber Institute

2023-06-26

978-1-61249-995-6