1 Introduction

The challenges of preventing, detecting, and responding to data leakage propagated by authorized users, or insider threats, are among the most difficult facing security researchers and professionals today. Prior to the advent of computing, security experts identified potential insider threats by examining suspicious activities in a person’s physical behavior. While still relevant in the modern era, we must now also detect suspicious activity in a person’s behavior on information systems. But the result is still fundamentally the same: malicious insiders continue to succeed in harming organizations by leaking sensitive information.

Research addressing this problem continues feverishly, but some critical questions remain unanswered. First, can a person’s intent be accurately characterized by monitoring and analyzing interactions with computing systems? That is, are the observations made by monitoring and auditing systems robust enough to allow automated characterization of malicious versus non-malicious behavior (or even informed guesses)? Secondly, is the malicious technical behavior of insiders anomalous any more often than the behavior of non-malicious users? If so, how often are malicious activities clearly anomalous? Finally, is anomalous behavior indicative of potential malicious intent, or do most insiders fall within the boundaries of normal behavior with respect to themselves, their peers, and their organization?

Researchers approach this problem from many different angles. Some propose highly technical solutions, using techniques applied to “Big Data,” or various statistical or graph analytic methods. Others attempt to discern the user’s intent or disposition via semantic, linguistic, or sentiment analysis of communication such as email or instant messaging. Still others propose combined approaches including analysis of technical events combined with observed behaviors not related to computing systems. Whatever the approach, researchers still struggle to define the problem, much less demonstrate the operational validity of their solutions. In this journal, we document four new approaches seeking to address components of the problem, with the goal of reducing the harm malicious insiders can inflict on an organization.

2 Defining and characterizing insider threats

One of the most important elements in any field of research is the common vernacular researchers use to describe problems and solutions. Unfortunately, insider threat and data leakage research has yet to fully mature in this respect. The literature presents a variety of definitions and characteristics of insiders. These characterizations often focus on different aspects of insider activity, which can be classified as technical, social, or socio-technical approaches to studying insider crime. For example, technical characteristics are the focus of Phyo and Furnell’s taxonomy of insider threats, which describes insider activity in terms of network level, system level, and application- and data-level misuses (2004). The social aspects are the focus of Wood’s attributes of an insider, which include access, knowledge, privileges, skills, risk, tactics, motivation, and process (2000). In contrast, Predd et al.’s four-dimensional approach, describing the organization, individual, system, and environment, presents a socio-technical approach (2008). The CERT Insider Threat Center’s current definition of insider threats similarly captures both social and technical elements, focusing on intent, the insider’s relationship to the organization and use of information technology (Cappelli et al. 2012):

A malicious insider threat to an organization is a current or former employee, contractor, or other business partner who has or had authorized access to an organization's network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization's information or information systems.

Overall, a variety of approaches are necessary to provide holistic solutions to the problem of insider threats, as illustrated by the variety of methods considered by the papers in this issue. In fact, such diversity was present even in the early days of IT-related insider threat research.

3 Insider threat research overview

In the 1990s, organizations such as the Department of Defense Personnel Security Research Center (PERSEREC) and the RAND Corporation focused academic discourse on the subject of insider threats, through publications and workshops (Anderson et al. 2000; Brackney and Anderson 2004; Anderson 1999; Wood and Wiskoff 2002). Beginning in 2001, the CERT Insider Threat Center also began conducting empirical research into the subject, through the development a database of insider threat cases. During this time period, researchers were also developing models of insider activity, identifying different characteristics of the insiders, the victim organization, and the incident itself. Focusing on behavioral aspects of insider crime, Shaw et al., identified psychological characteristics, such as computer dependency, ethical flexibility and lack of empathy as potential indicators of a risk for destructive and potentially illegal behavior (1998). Focusing on the social-technical approach, Schultz viewed personality traits and technical behaviors, including usage patterns, and meaningful errors, to identify insiders through weighted indicators (2002). Presenting a technical approach, Maybury et al. studied different mechanisms for monitoring technical data in order to detect malicious IT activity (2005).

A recent overview by Hunker and Probst also categorized insider threat studies as technical, social, or socio-technical approaches (2011). In this review, the authors noted that social approaches to insider threats often focus on motivations, organizational culture, workplace reporting. The authors categorized technical studies as primarily focused in areas such as access controls, monitoring, and policy languages. Finally Hunker and Probst also note work in the socio-technical area, which they note often includes policy, monitoring, prediction, and response work. One example of this approach can be seen in Kandias et al.’s prediction model, which combines psychometric tests and monitoring data from honey tokens and hybrid intrusion detection (2010).

4 Insider threats and data leakage

Data leakage can be characterized as several different types of crimes perpetrated by insiders, including theft of personally identifiable information (to commit fraud, for example), theft of intellectual property, or for an insider to pass sensitive or classified information to an unauthorized third party. It has been noted that data leakage can also refer to inadvertent data loss, however that is beyond the scope of this article (McCormick 2008).

McCormick characterized data leakage and theft into three stages: obtaining access, downloading data, and sharing data (2008). The study outlines common motivation for leaking, often revenge or profit, and notes that leakers sometimes collude with someone outside the organization. McCormick also delineated some potential technical and administrative controls for addressing the threat, including “tightening control on removable media”, using data loss prevention tools, and training employees on handling sensitive information.

Other researchers have also addressed the first stage of data leakage, data access. Mathew et al. presented a method of modeling access as a way to begin to understand normal and abnormal access patterns and mitigate insider threats to database information (2010). Aleman-Meza et al. studied the problem of legitimate document access, that is assuring an employee is within their ‘need to know’ when accessing information (2005). The researchers in this study focused on capturing the context of an employee’s need to know and computing semantic associations for documents related to determine the relevance of the document to the employee’s need to know.

Surveys and subsequent reports have also been done, providing insight into the amount and impact of insider breaches in a given year. For example, Verizon data breach report includes insiders as a threat agent. The 2012 report noted that internal agents caused four percent of breaches, although they noted that this number might not be representative of all insider data breaches due to low levels of reporting (2012). The report also notes that most internal breaches are deliberate and malicious.

Several studies have been done with a focus on the theft of intellectual property. In 2009, Moore et al. presented two scenarios for insider intellectual property theft (2009). One model, the Entitled Independent, characterized lone insiders who steal information for a new business opportunity, although in most cases the insider has no specific plans for the information’s use. The other model, the Ambitious Leader, characterized insiders who recruit others to steal information, either to develop or benefit a competing organization. More recently, the CERT Insider Threat center has focused on detecting intellectual property theft around the time of employee termination, with Hanley and Montelibano publishing a control and Moore et al. publishing a pattern on the subject (Hanley and Montelibano 2011; Moore et al. 2012). Additionally, Shaw and Stock published a white paper on the psychology of insiders who commit intellectual property theft, noting examples of ‘observable workplace risk indicators’ and discussing various mitigating strategies, including employee screening and employee reporting programs (2011).

5 Current issue

The papers in this issue address the threat of insider data leakage from a variety of perspectives. Beginning with a behavioral focus, the first paper, “Understanding Insiders: An Analysis of Risk-Taking Behavior” by Fariborz Farahmand and Eugene H. Spafford (2013), explores accepted models of perceptions of risk and the unique characteristics of insider threats. It then introduces metrics to measure the insider’s perceptions of risk. In addition, the authors investigate various decision theories, and conclude that prospect theory, developed by Tversky and Kahneman, is the most useful for explaining the risk-taking behavior of insiders.

Moving into more technical solutions, the second paper, “Knowing Who to Watch: Accumulating Evidence of Subtle Attacks” by Howard Chivers et al. (2013), proposes a scalable solution to combining large volumes of evidence from multiple sources gathered over a long period of time. The paper proposes storing long term estimates that entities are attackers, rather than storing the event data itself. The authors identify the essential attributes of the event data and show how to apply Bayesian statistics to update the estimates. They demonstrate the effectiveness of their approach with a simulated slow-attack on a network.

The next article also focuses on a technical approach. Entitled “Two-Stage Database Intrusion Detection by Combining Multiple Evidence and Belief Update” by Suvasini Panigrahi, Shamik Sural and A. K. Majumdar (2013), this article introduces a two-stage database intrusion detection system, which applies anomaly detection for first level inferences followed by misuse detection in the second stage. The system uses inter-transactional as well as intra-transactional techniques for detecting intrusions. The authors analyze the performance of their system using stochastic models and compare it to two other previously published systems.

The final paper also addresses the protection of databases. “Application of Density-based Outlier Detection to Database Activity Monitoring” by Seung Kim et al. (2013), presents a method for the efficient detection of outliers when monitoring database activity. The authors exploit a kd-tree index and an approximated k-nn search method. The proposed approach was successfully applied to a very large log dataset collected from the Korea Atomic Energy Research Institute (KAERI).