A Technical History of the SEI

Insider Threat
The Challenge: Cyber Attacks by Insiders
Insiders pose a challenging cybersecurity threat. They
are trusted employees, former employees, or even contractors
with access to internal systems and sensitive information;
because they have (or recently had) authorized,
trusted access, it is hard to protect against their
malicious actions [Trembly 2011]. These actions include
IT sabotage, fraud, theft of confidential or proprietary
information, espionage, and threats to U.S. critical infrastructure
[Gupta 2008]. The actions of a single insider
have resulted in a range of impacts, including loss of
staff hours, loss of reputation and customer trust, and financial
damage so extensive that businesses have been
forced to lay off employees or cease operation. Damage
from insider incidents can have far-reaching repercussions,
creating serious risks to public safety and national
security, such as disruption of a service in a critical infrastructure,
disclosure of classified information, or industrial
espionage. Addressing insider threat is a challenge,
as technological solutions alone are ineffective.
The View from Others
They have a great insider threat
research team up there; they’ve
been working on this for over 10
years.
– Dr. Ron Ross, National
Institute of Standards and
Technology [SEI 2011]
CERT is offering a fantastic Insider
Threat Workshop that will be
of extreme benefit to anybody in
the computer security industry.
– Lauren Gerber, in
PC1news.com
[Gerber 2009]
A Solution: Insider Threat Research and Solutions
The SEI has become a center of expertise on identifying and mitigating insider threat [Kaplan
2011]. The SEI first investigated the malicious actions of insiders in 2000, when the DoD sponsored
research to identify characteristics of the environment surrounding insider incidents in the
military services and defense agencies. The findings guided ongoing efforts to reduce the threat to
critical information systems in the DoD and its contractor community. This work was the beginning
of an ongoing partnership between the SEI and the DoD’s Defense Personnel Security Research
Center (PERSEREC). The following year, the U.S. Secret Service National Threat Assessment
Center (NTAC) and the SEI worked together to conduct a unique study of insider
incidents—psychologists from NTAC and technical experts from the SEI examined insider cases
both from a behavioral and a technical perspective. It was the first study that used this dual approach.
In 2002, SEI security experts assisted the U.S. Secret Service (USSS) with the cyber aspect
of its protection mission at the Salt Lake City Olympic Games, categorized as a National Security
Special Event. In talking with the Olympic Committee and considering potential problems,
SEI staff realized the criticality and extent of insider threat. Work with the Secret Service continued,
and research was stepped up. In 2013, the Secret Service honored SEI insider threat experts
for their “efforts and superior contributions” to USSS law enforcement responsibilities. 39
In 2003 and 2004, the Department of Homeland Security (DHS) added its sponsorship to the insider
threat study and to building a database of the valuable information collected during the
39 See http://www.sei.cmu.edu/newsitems/USSS-award.cfm
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 184
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.