The CERT Insider Threat Center

Mission
To enable effective insider threat programs

by performing research, modeling, analysis, and outreach to define socio-technical best practices

so that organizations are better able to deter, detect, and respond to evolving insider threats.

A malicious insider threat to an organization is a current or former employee, contractor, or other business partner who has or had authorized access to an organization's network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization's information or information systems.

The CERT Insider Threat Center conducts empirical research and analysis to develop and transition socio-technical solutions to combat insider cyber threats. We have been doing research on this problem since 2001 in partnership with the Department of Defense, the Department of Homeland Security, the U.S. Secret Service, other federal agencies, the intelligence community, private industry, academia, and the vendor community.

The foundation of our work is our database of more than 700 insider threat cases. We use system dynamics modeling to characterize the nature of the insider threat problem, explore dynamic indicators of insider threat risk, and identify and experiment with administrative and technical controls for insider threat mitigation. The CERT insider threat lab provides a foundation to identify, tune, and package technical controls as an extension of our modeling efforts. We have developed an assessment framework based on the fraud, theft of intellectual property, and IT sabotage case data that we have used to help organizations identify their technical and nontechnical vulnerabilities to insider threats as well as executable countermeasures.

The CERT Insider Threat Center is uniquely positioned as a trusted broker to assist the community in the short term and through our ongoing research.

Our work consists of the following:

• Case analysis and best practices
• Modeling and simulation
• Espionage research
• Mitigation controls, patterns, and pattern languages
• Identifying and detecting early-warning indicators
• Developing and conducting assessments and workshops
• Insider threat blog
• Insider threats in the software development lifecycle
• Annual eCrime Watch Survey