Below are a few research papers and articles that may be of interest to you. If you would like to talk to one our team to discuss the impact of insider risk on your organisation, please feel free to contact us. We would be happy to discuss the risks your organisation may face and how we can help.
Behavioural Assessment and Insider Risk
- The Global State of Information Security® Survey (2018) Strengthening digital society against cyber shocks. Global State of Information Security Survey.
- Ponemon Institute (2017). Ponemon Institute LLC Cost of Data Breach Study.
- Security Policy Reform Council. Insider Threat Subcommittee. (2017). Assessing the Mind of the Malicious Insider: Using a Behavioural Model and Data Analytics to Improve Continuous Evaluation. Intelligence and National Security Alliance (INSA).
- Wetzel, J. (2017). Insider Threats to Financial Services: Uncovering Evidence with External Intelligence. Recorded Future.
- Ponemon Institute (2016). Ponemon Institute LLC Cost of Data Breach Study.
- Scott, J., and Spaniel, D. (2016) In 2017, the Insider Threat Epidemic Begins. Institute for Critical Infrastructure and Technology (ICIT). Washington D.C. ICIT.
- Costa, D., Albrethsen, M., Collins, M., Perl, S., Sllowash, G., Spooner, D. (2016). An Insider Threat Indicator Ontology. Carnegie Mellon University CERT Division. Software Engineering Institute.
- CERT Insider Threat Center. (2016). Common Sense Guide to Mitigating Insider Threats, Fifth Edition. Carnegie Mellon University CERT Division. Software Engineering Institute.
- Moore, A., Perl, S., Cowley, J., Collins, M., Cassidy, T., VanHoudnos, N. (2016). The Critical Role of Positive Incentives for Reducing Insider Threats. Carnegie Mellon University CERT Division. Software Engineering Institute.
- Shuyuan Mary Ho, S. M., Hancock, J. T., Booth, C., Burmester, M., Liu, X., Timmarajus, S. S. (2016). Demystifying Insider Threat: Language-Action Cues in Group Dynamics, 2016
- Moore, A., Novak, W., Collins, M., Trzeciak, R., Theis, M. (2015). Effective Insider Threat Programs: Understanding and Avoiding Potential Pitfalls. Carnegie Mellon University. Software Engineering Institute.
- Shaw, E. and Seller, L. (2015). Application of the Critical Path-Method to Evaluate Insider Risk. Studies in Intelligence. Vol. 59 (2), pp 1-8.
- Cole, E. (2015). Insider Threats and The Need for Fast and Directed Response. SANS Institute Reading Room.
- (2015). Analytic Approaches to Detect Insider Threats. Carnegie Mellon University.
- Moore, A., Collins, M.,Mundie, D., Ruefle, R., McIntire, D. (2014). Pattern-Based Design of Insider Threat Programs. Carnegie Mellon University CERT Division. Software Engineering Institute.
- Upton, D., Creese, S. (2014). The Danger from Within. Harvard Business Review.
- CERT (2013). Unintentional Insider Threats: A Foundational Study
- CPNI (2013). Insider Data Collection Study. Critical National Infrastructure Insider Risk, Report of Main Findings
- Shaw, E., Payri, M., Cohn, M., and Shaw, I. (2013a) “How Often Is Employee Anger An Insider Risk II? Detecting and Measuring Negative Sentiment Versus Insider Risk in Digital Communications—Comparison Between Human Raters and Psycholinguistic Software.” Journal of Digital Forensics, Security and the Law, Volume 8, Issue 2, in press.
- Shaw, E., Payri, M., Cohn, M., and Shaw, I. (2013b) “How Often Is Employee Anger An Insider Risk I? Detecting and Measuring Negative Sentiment Versus Insider Risk in Digital Communications,” Journal of Digital Forensics, Security and the Law, Volume 8, Issue 1, pages 39-71.
- Flynn, L., Huth, C., Trzeciak, R., Buttles, P. (2013). Best Practices Against Insider Threats in All Nations. Carnegie Mellon University CERT Division. Software Engineering Institute.
- Cummings, A., Lewellen, T., McIntire, D., Moore, A., and Trzeciak, R. (2012). Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S. Financial Services Sector. Carnegie Mellon University CERT Program. Software Engineering Institute.
- Lockheardt, C. (2012). The Human Factor: Using Behavioral Science to Counter Insider Threats. MITRE.
- Moore, A., Cappelli, D., Caron, T., Shaw, E., Spooner, D., (2011). A Preliminary Model of Insider Theft of Intellectual Property. Carnegie Mellon University. Software Engineering Institute.
- Hunker, J., & Probst, C. W. (2011). Insiders and Insider Threats: An Overview of Definitions and Mitigation Techniques. JoWUA, 2(1), 4-27.
- Shaw, E. D. and Stock, H. (2011) Behavioral Risk Indicators of Malicious Insider Theft of Intellectual Property: Misreading the Writing on the Wall. Symantec Corporation White Paper, December 6.
- Shaw, E.D., Fischer, L., and Rose, A. (2009) “Insider Risk Evaluation and Audit,” Department of Defense Technical Report 09-02, August.
- Defense Personnel Security Research Center. (2009). Espionage and Other Compromises in National Security: 1975 to 2008. PERSEREC.
- Kowalski, E., Capelli, D., and Moore, A. P. (2008). Insider Threat Study: Illicit Cyber Activity in the Information Technology and Telecommunications Sector. Insider Threat Study: Illicit Cyber Activity in the Information Technology and Telecommunications Sector
- Band, S., Cappelli, D., Fischer, L. Moore, A, Shaw, E. and Trezciek, R. (2006) Comparing Insider IT Sabotage and Espionage: A Model-Based Approach, Technical Report CMU/SEI-2006-TR-026, Software Engineering Institute, Carnegie Mellon
- Shaw, E.D. (2006) “The Role of Behavioral Research and Profiling in Malicious Cyber Insider Investigations,” Digital Investigation, The International Journal of Digital Forensics and Incident Response, Vol. 3, pps. 20-31, Elsevier Publications, Exeter, UK
- Shaw, E.D. and Fischer, L. (2005) Ten Tales of Betrayal: An Analysis of Attacks on Corporate Infrastructure by Information Technology Insiders, Volume One,” Monterey, CA.: Defense Personnel Security Research and Education Center. FOUO
- Shaw, E.D. (2004). “The insider threat: Can it be managed?” In Parker, T. (Ed.), Cyber Adversary Characterization: Auditing the Hacker Mind, June. Syngress Publications, Rockland, Mass. ISBN: 1-931836-11-6
- Shaw, E.D., & Stroz, E. (2004). WarmTouch software: Assessing Friend, Foe and Relationship.” In Parker, T. (Ed.), Cyber Adversary Characterization: Auditing the Hacker Mind. June. Syngress Publications, Rockland, Mass. ISBN: 1-931836-11-6
- Shaw, E.D. (2002). Profiling the corporate information technology insider. Monterey, CA: Defense Personnel Security Research Center.
- Shaw, E. (2001). “To Fire or Not to Fire,” Information Security, January.
- Shaw, E., Post, J. and Ruby, K. (2000). “Managing the Insider Threat: The Personnel Security Audit,” Information Security, July.
- Shaw, E., Ruby, K., and Post, J. (1998). The Insider Threat to Information Systems: The Psychology of the Dangerous Insider. Security Awareness Bulletin, No. 2-98, pp.1-10.
- Central Intelligence Agency (CIA). Intelligence Community Staff. (1990). Project Slammer Interim Report. Washington D.C.