Insider Threat Detection: A Solution in Search of a Problem

No ratings

Presented at CyberScience2020 2020 by

Jordan Thomson

Insider threats (IT) reflects a growing concern in the security communities. Despite a rapid increase in thenumber of papers examining IT, definitions, research methods, and models, critical evaluations are rare. The presentpaper provides a critical review of these issues. Definitions of insider threat have varied from general, focusing on allforms of organizational deviant behavior to specific, focusing on individual difference and social context variables.Research methods include models based on deductive principles and based on intuitions of subject matter experts,computational models based on social media activity, and empirical observations based on synthetic or inaccessibledata sets, i.e., black data. Following a review of these considerations, we demonstrate that many existing approacheswithin the behavioral and social sciences can provide more solid foundations to the IT literature. Using insight fromresearch on organizational deviant behavior and workplace incivility, we conclude by proposing a multidimensionalclassification system for insider threat SIEVE: severity (S), intentionality (I), type of employee norm violation (EV),and ethicality (E).