Analytics for early detection of insider threat

Incidents related to insider threats are steadily increasing, especially technology thefts.¹ Dr. Larry Ponemon wrote, “insider threats are not viewed as seriously as external threats, like a cyber-attack. But when companies had an insider threat, in general, they were much more costly than external incidents. This was largely because the insider that is smart has the skills to hide the crime, for months, for years, sometimes forever.”² Insider threat is a relatively rare occurrence, often perpetuated by revenge seeking employees with a grievance against their employer. The capitol assault was an eye-opening event in that it clearly demonstrated that insiders, in this case military and ex-military, were willing to engage in violence against the government. Detection of insider threat is a difficult problem as data is limited and the factors surrounding insider threat are highly contextual. Previous research tends to focus on theoretical perspectives and threat mitigation, frequently emphasizing cyber-technical indicators of insider threat versus focusing on the human behind the screen.³ More behavior focused research has identified several psychosocial, individual-level risk factors for insider threat (e.g., disgruntlement, poor work performance, etc.) or has conducted personality assessments on known insiders post-hoc. ⁴,⁵ However, future directions in this line of research need to address early detection of mobilization as part of the defensive strategy against these threats. Subsequently, this paper will summarize the state-of-the-knowledge in terms of research on behavioral factors and approaches for insider threat detection, highlighting methods for assessing social-cyber information to enable early detection of insider threat.