A Technical History of the SEI

which SEI insider threat experts use to collect data that organizations can use as a benchmark. As
a supplement to the face-to-face workshops already in place, insider threat experts developed exercises
for STEPfwd, an SEI web-based platform that enables participants in multiple locations to
work together on simulations of the latest threats. Both government and private industry have
taken advantage of the ITAs and the online exercises.
In 2009, the SEI set up the CERT Insider Threat Lab, where its technologists could test existing
technical solutions for the insider threat problem and identify new or refined solutions in gap areas.
For example, research is underway on methods that help cloud service providers deal with insider
threats [Porter 2013]. The lab is developing new technical controls for government and industry
and making the controls available online. 44
The Consequence: Improved Insider Threat Detection and Response
Using SEI results, information assurance staff and counterintelligence analysts have implemented
technical controls for catching insiders. The DoD and federal civilian agencies can now identify
insider threat proactively using SEI techniques and tools instead turning to forensics after the
crime. In case of an attack, organizations are armed with policies, practices, and technical
measures to help with recovering from the attack, identifying the perpetrator, and implementing
new measures for improved incident management in the future.
The SEI Contribution
Law enforcement had long been profiling miscreants in general but did not focus on insider threat
to computer systems and the information that resides on them. Similarly, network security experts
focused on protecting against the technical attacks from outside the perimeter rather than attacks
from inside. The SEI contribution was to examine cyber attacks by insiders from both technical
and behavioral perspectives and to use real-life cases in this research. The ultimate goal of SEI insider
threat research is to help all organizations, including the DoD, federal agencies, and critical
sector industries, prevent insider attacks and, if there is such an attack, to provide these organizations
with the tools, techniques, and methods that enable them to detect and respond to the illicit
activity early, thus minimizing the impact to critical assets. This goal is well on its way to realization.
References
[Cappelli 2012] Cappelli, Dawn; Moore, Andrew P.; & Trzeciak, Randy. The CERT Guide to Insider
Threat: How to Prevent, Detect, and Respond to Information Technology Crime. Addison
Wesley Professional, February 2012 (ISBN 0321812573).
[CERT IT Team 2013] Unintentional Insider Threats: A Foundational Study (CMU/SEI-2013-
TN-022). Software Engineering Institute, Carnegie Mellon University, 2013. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=58744
[Chabrow 2011] Chabrow, Eric. “Obama Reiterates Cybersec as a Priority.” The Public Eye. December
1, 2011. http://www.inforisktoday.com/blogs/public-eye-b-13/p-21
44 See http://www.cert.org/insider-threat/research/controls-and-indicators.cfm
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 186
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.