Piloting the Exchange of Insider Threat Reports: Information Sharing Challenges to Proactive Cyber Fraud Identification

Abstract

Research published by the SWIFT Institute in August 2017, titled “Sharing Insider Threat Indicators: Examining the Potential Use of SWIFT’s Messaging Platform to Combat Cyber Fraud” proposed a protocol for sharing insider threat activities between financial institutions. Building from the assumption that cyber criminals work off a shared services model to give them access to infrastructure, tools, targets and options for monetizing their exploits, the research asserted the strengthening of communication channels for defenders to share real time threat information is essential to pre-empting cyber fraud. A pilot to test this information sharing protocol through the development of an Insider Threat Report (ITR) message type was initiated in late September 2017. The pilot ran for 12 months during which time participants from financial and investment services firms worked together to validate a set of insider threat indicators based on actual use cases from internal investigations and customized the ITR fields for transmitting the information over the SWIFT messaging platform. The pilot concluded with a number of findings on key challenges to this level of information sharing that, until resolved, will prevent member organizations from formalizing their engagement on this effort.