Insider Threat Study - Revision history

WikiSysop: /* Additional Notes and Highlights */

2010-08-09T19:38:15Z

Additional Notes and Highlights

← Older revision		Revision as of 19:38, 9 August 2010
Line 75:		Line 75:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			Expertise Required: None

Jalbert: /* Key Words */

2010-07-29T16:25:05Z

Key Words

← Older revision		Revision as of 16:25, 29 July 2010
Line 13:		Line 13:
	* Issues: [[Incentives]]; [[Usability/Human Factors]]		* Issues: [[Incentives]]; [[Usability/Human Factors]]

	==Key Words==		==Key Words==


			[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud \| Credit Card Fraud]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Crime \| Cybercrime]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]]

	==Synopsis==		==Synopsis==

Jalbert: /* Categorization */

2010-07-29T16:21:52Z

Categorization

← Older revision		Revision as of 16:21, 29 July 2010
Line 10:		Line 10:
	==Categorization==		==Categorization==
	* Resource by Type: [[US Government Reports and Documents]]		* Resource by Type: [[US Government Reports and Documents]]
	* Threats and Actors: [[Financial Institutions and ~~networks~~]]		* Threats and Actors: [[Financial Institutions and Networks]]
	* Issues: [[Incentives]]; [[Usability/Human Factors]]		* Issues: [[Incentives]]; [[Usability/Human Factors]]

Jalbert: /* Categorization */

2010-07-29T16:21:34Z

Categorization

← Older revision		Revision as of 16:21, 29 July 2010
Line 10:		Line 10:
	==Categorization==		==Categorization==
	* Resource by Type: [[US Government Reports and Documents]]		* Resource by Type: [[US Government Reports and Documents]]
			* Threats and Actors: [[Financial Institutions and networks]]
			* Issues: [[Incentives]]; [[Usability/Human Factors]]

	==Key Words==		==Key Words==

Jalbert: /* Synopsis */

2010-07-29T16:19:00Z

Synopsis

← Older revision		Revision as of 16:19, 29 July 2010
Line 17:		Line 17:
	==Synopsis==		==Synopsis==

			In the past, most incidents of fraud against the banking or financial services industry were committed by insiders. It is difficult to estimate how often and to what degree companies face attacks from within; insider attacks are probably under-reported, out of fear for the negative publicity or increased liability that may arise as a consequence.

			The Insider Threat Study examines a series of unique insider incidents from a behavioral and technical perspective.

			'''Scope and Procedure of the Insider Threat Study'''

			The report examines 23 incidents carried out by 26 insiders in the banking and
			finance sector between 1996 and 2002. Organizations affected by insider activity
			in this sector include credit unions, banks, investment firms, credit bureaus, and
			other companies whose activities fall within this sector. Of the 23 incidents, 15
			involved fraud, four involved theft of intellectual property, and four involved
			sabotage to the information system/network.

			The study consists of an aggregated case-study analysis that provides an in-depth look at insider incidents that have occurred in critical infrastructure sectors between 1996 and 2002, a review of the prevalence of insider activity across critical infrastructure
			sectors over a 10-year time frame, and a survey of recent insider activity experienced by a sample of public- and private-sector organizations.

			Cases were identified through public reporting or as a computer fraud case
			investigated by the Secret Service.

			The ITS adapted methods used in previous research performed by the Secret
			Service and CERT/CC to conduct in-depth examinations of network, system, and
			data compromises and other insider activity. Researchers focused primarily on
			tracing insider incidents from the initial harm backward in time to when the idea
			of committing the incident first occurred to the insider. In tracing the incidents
			backward, researchers tried to identify the behaviors and communications in
			which the insiders engaged – both online and offline – prior to and including the
			insiders’ harmful activities.

			'''Insider Fraud Requires Little Technical Sophistication'''

			Most of the incidents examined in the banking and finance sector were not
			technically sophisticated or complex. That is, they typically involved exploitation
			of non-technical vulnerabilities such as business rules or organization policies
			(rather than vulnerabilities in an information system or network) and were carried
			out by individuals who had little or no technical expertise.

			This suggests it is important for organizations to secure their networks from the full range of users, from persons responsible for data entry to management to system administrators. Proactive practices, such as mandatory password protection and change
			policies, and use of password-protected screen savers, can minimize the
			possibility of insiders using another employee’s computer and/or account to carry
			out the attack.

			'''Perpetrators Planned Their Actions'''
			Most of the incidents were thought out and planned in advance. In most cases,
			others had knowledge of the insider’s intentions, plans, and/or activities. Those
			who knew were often directly involved in the planning or stood to benefit from the
			activity.

			'''Financial Gain Motivated Most Perpetrators'''
			Most insiders were motivated by financial gain (81%), rather than a desire to harm the
			company or information system. Other motives included revenge, dissatisfaction
			with company management, culture or polices, and a desire for respect.

	==Additional Notes and Highlights==		==Additional Notes and Highlights==

WikiSysop at 16:22, 26 July 2010

2010-07-26T16:22:05Z

← Older revision		Revision as of 16:22, 26 July 2010
Line 20:		Line 20:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
	~~{\| class="wikitable sortable" border="1"~~
	~~\|+ Sortable table~~
	\|-
	~~! Alphabetic !! Numeric !! Date !! class="unsortable" \| Unsortable~~
	\|-
	~~\| d \|\| 20 \|\| 2008-11-24 \|\| This~~
	\|-
	~~\| b \|\| 8 \|\| 2004-03-01 \|\| column~~
	\|-
	~~\| a \|\| 6 \|\| 1979-07-23 \|\| cannot~~
	\|-
	~~\| c \|\| 4 \|\| 1492-12-08 \|\| be~~
	\|-
	~~\| e \|\| 0 \|\| 1601-08-13 \|\| sorted.~~
	\|}

WikiSysop at 16:21, 26 July 2010

2010-07-26T16:21:40Z

← Older revision		Revision as of 16:21, 26 July 2010
Line 20:		Line 20:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			{\| class="wikitable sortable" border="1"
			\|+ Sortable table
			\|-
			! Alphabetic !! Numeric !! Date !! class="unsortable" \| Unsortable
			\|-
			\| d \|\| 20 \|\| 2008-11-24 \|\| This
			\|-
			\| b \|\| 8 \|\| 2004-03-01 \|\| column
			\|-
			\| a \|\| 6 \|\| 1979-07-23 \|\| cannot
			\|-
			\| c \|\| 4 \|\| 1492-12-08 \|\| be
			\|-
			\| e \|\| 0 \|\| 1601-08-13 \|\| sorted.
			\|}

WikiSysop: /* Categorization */

2010-07-23T20:18:59Z

Categorization

← Older revision		Revision as of 20:18, 23 July 2010
Line 9:		Line 9:

	==Categorization==		==Categorization==
	* ~~Resources~~ by Type: [[US Government Reports and Documents]]		* Resource by Type: [[US Government Reports and Documents]]

	==Key Words==		==Key Words==

WikiSysop at 20:06, 23 July 2010

2010-07-23T20:06:07Z

← Older revision		Revision as of 20:06, 23 July 2010
Line 7:		Line 7:

	[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&view=detailed&startkey=USSS:2004&f=wikibiblio.bib BibTeX]		[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&view=detailed&startkey=USSS:2004&f=wikibiblio.bib BibTeX]


	==Categorization==		==Categorization==
			* Resources by Type: [[US Government Reports and Documents]]
	~~Overview~~: [[US Government Reports and Documents]]

	==Key Words==		==Key Words==

WikiSysop: /* Categorization */

2010-07-08T16:40:41Z

Categorization

← Older revision		Revision as of 16:40, 8 July 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	Overview: [[Government Reports and Documents]]		Overview: [[US Government Reports and Documents]]

	==Key Words==		==Key Words==