Review of insider and insider threat detection in the organizations

Abstract

Aim: One of the major threats in cyber security is the insider threat. Most of the organizations are unaware of the insider threats. The organizational insiders like employees, system administrators and third party contractors have secret information related to the organizations. Protecting such secret information is very crucial to safeguard the organizational financial and reputational losses. Most of the authorized employees have access to confidential data when it bypasses the security it may lead to huge loss to the organization. Identifying and preventing the insider threat is a major challenge in any organization to safeguard it from the malicious acts of the insiders. This research study is aim at identifying the insider threat involved in any organization and the ways to protect these threat.Methodology: This paper reviews the research done on the insider threat classifying the research into three categories, the first one is about the insiders - representing types of insiders, motivation, insider access, methods used by insiders, insider profiling and levels of insiders, the second one is about the threat detection methods - describing the methodology, techniques, the datasets used to implement the different insider threat detection techniques and the various analyzed behavior of the user, the third one is insider threat analysis representing various evaluation metrics used.Findings: In the current digital era, one of the dangerous threats to organizations is due to the insiders. Most of the organizations are facingissues with insider threats since the global changes in the business environment. Excessive use of cloud and BYOD concepts to work fromhome was one of the major reason to increase the insider threat since 2019.Implications/Novel Contribution: Some of the recommendations for upcoming research are to use the hybrid solution to develop theeffective models to detect the insider threats, to enhance threat detection methods, and evaluate the performance of the existing methods usingthe live dataset.