Objectives of the Insider Threat Problem Thread.pdf

System Dynamics Modeling for Information Security: Invitational Group Modeling Workshop Preliminary Description of Thread on the Insider Threat Problem Proposal Contributors ? SEI/CERT, USA (PA): Chris Bateman, Dawn Cappelli, Casey Dunlevy, Andrew Moore, Dave Mundie, Stephanie Rogers, Tim Shimeall ? TECNUN, University of Navarra, Spain: Jose Maria Sarriegui ? Syracuse University, USA (NY): Jeff Stanton ? Agder University College, Norway: Jose J. Gonzalez Proposal history Proposed: January 23, 2004 Revised: January 29, 2004 Objectives of the Insider Threat Problem Thread ? to develop a preliminary System Dynamics model of some important aspect of the insider threat problem, based in part on an ongoing study of insider compromises across the US critical infrastructure sectors conducted by the U.S. Secret Service and the SEI/CERT ? to determine whether it is feasible to develop a generic system dynamics model for insider threat that will be useful to all organizations, or at least all organizations within a single critical infrastructure sector Objectives of this Proposal ? to scope the aspect of the insider threat problem to be dealt with in the workshop ? to describe the problem in sufficient detail so as to provide a good starting point for the workshop and to ensure a good chance of success ? to provide a range of options in problem formulation that allows quick narrowing of problem scope at the beginning of the workshop according to the interests of the participants ? to provide the opportunity for other workshop participants to review and provide feedback for further refinement of this proposal prior to the actual workshop Insider Threat Thread Problem Outline 1. What is the real problem (not just a symptom of the difficulty)? a. Insider attacks cause organizations major damage to their reputation, employee morale, and bottom line. 2. Why is it a problem? a. Explanation 1: Insider threat is a low base rate problem (similar to