A Technical History of the SEI

study. In 2011, the DoD began funding development of a version of the database for use by government
researchers and law enforcement. 40 The studies [CSO 2004] 41 and database development
work led to the development of best practices [Cappelli 2012] 42 and models [Moore 2008], 43 both
funded by CyLab at Carnegie Mellon University. The models, which include behavioral traits and
technical actions, reveal indicators that might alert an organization
to the potential for malicious acts by insiders
[Greene 2010]. Model development is ongoing, with
models now available for insider IT sabotage, insider
theft of intellectual property, and national security espionage.
In 2011-12, development began on a fraud model
with the USSS, Department of Treasury, and the financial
sector (sponsored by DHS). In 2012, the SEI expanded
its research and case collection process to include
insider incidents that occur outside the United
States as well as those perpetrated by insiders but without
malicious intent. This expansion has allowed international
[Flynn 2013] and unintentional insider threat
studies [CERT IT Team 2013], providing a more complete
picture of the threat posed by insiders to organization’s
critical assets.
The SEI conducts workshops on how to apply the practices
and models. To extend its impact, the SEI published
The CERT Guide to Insider Threats: How to Prevent,
Detect, and Respond to Information Technology
Crimes, which combines 10 years of research into one
practical guide [Cappelli 2012]. SEI insider threat experts
also worked with the Carnegie Mellon Entertainment
Technology Center to create a prototype interactive
virtual simulation tool—essentially a video game—
teaching insider threat mitigation.
The View from Others
New research from Carnegie
Mellon University’s Software Engineering
Institute provides further
evidence why information security
isn’t just the problem of an enterprise’s
IT and IT security organization
but of its top non-IT leadership
as well.
– Eric Chabrow, in The Public
Eye, a government security
blog [Chabrow 2011]
The Insider Threat Study is an excellent
example of collaboration
between the federal government
and private sector to safeguard the
financial payment systems of the
United States.
– Ryan Moore, Assistant to
the Special Agent in
Charge, USSS, in a press
release on an award to SEI
Insider Threat staff
members
[SEI 2013]
In response to community need, the insider threat team
redirected its research toward solution-oriented activities.
With seed funding from Carnegie Mellon’s CyLab, the team developed insider threat assessments
(ITAs), which are based on more than 4,000 indicators (organized into more than 130 categories)
identified in the Insider Threat Database. DHS funded development of the ITA, Version 2,
40 In this version of the database, identities were made anonymous.
41 The first study [CSO 2004], and subsequent studies and analyses are available on the CERT website
(http://www.cert.org/insider_threat).
42 Practices can be found in a set of reports available at http://www.cert.org/insider-threat/publications/index.cfm.
One of the best known is the “Common Sense Guide,” now in its fourth edition
[Silowash 2012].
43 The report describes the first model developed [Moore 2008]. This model and others can be found
at http://www.cert.org/insider-threat/research/Modeling-and-Simulation.cfm.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 185
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.