Insider threat

Abstract

An insider threat can be defined with regard to two primitive actions: violation of a security policy using legitimate access and violation of an access control policy by obtaining unauthorized access. It would be useful to consider what the security community considers the insider threat to be and how it manifests itself. D. Schultz pointed out how little was understood on insider threats at the time and discussed the many misconceptions that surrounded the issue. The insider threat might not be as frequent as malicious software, but its impact can be costly. Beyond prevention and detection, though, best practices and guidelines recognize that insider threat is a multifaceted problem, and the success of insider threat mitigation strategies depends on the cooperation of various groups within an organization. The opportunity in psychological models is a widely used feature for detecting insider threats.