Guest editorial: A brief overview of data leakage and insider threats
---
paper_title: A pattern for increased monitoring for intellectual property theft by departing insiders

paper_content:

A research project at the CERT® Program is identifying enterprise architectural patterns to protect against the insider threat to organizations. This paper presents an example of such a pattern---Increased Monitoring for Intellectual Property (IP) Theft by Departing Insiders---to help organizations plan, prepare, and implement a means to mitigate the risk of insider theft of IP. Our case data shows that many insiders who stole IP did so within 30 days of their termination. Based on this insight, this pattern helps reduce that risk through increased monitoring of departing insiders during their last 30 days of employment. The increased monitoring suggested by the pattern is above and beyond what might be required for a baseline organizational detection of potentially malicious insider actions. Future work will develop a library of enterprise architectural patterns for mitigating the insider threat based on the data we have collected. Our goal is for organizational resilience to insider threat to emerge from repeated application of patterns from the library.
---
paper_title: Insider Threat Control: Using Centralized Logging to Detect Data Exfiltration Near Insider Termination

paper_content:

Abstract : Since 2001, the CERT(registered trademark) Insider Threat Center has built an extensive library and comprehensive database containing more than 600 cases of crimes committed against organizations by insiders. A significant class of insider crimes, insider theft of intellectual property, involves highly damaging attacks against organizations that result in significant tangible losses in the form of stolen business plans, customer lists, and other proprietary information. The Insider Threat Center's behavioral modeling of insiders who steal intellectual property shows that many insiders who stole their organization's intellectual property stole at least some of it within 30 days of their termination. This technical note presents an example of an insider threat pattern based on this insight. It then presents an example implementation of this pattern on an enterprise-class system using the centralized log storage and indexing engine Splunk to detect malicious insider behavior on a network.
---
paper_title: Data Theft: A Prototypical Insider Threat

paper_content:

The author is the lead information security architect at one of the United States’ largest banks. In this paper he assesses the threat of confidential data leakage, focusing on its most virulent form – insider data theft attacks. Technological and procedural controls typically found in enterprise environments are reviewed and found inadequate. Additional controls are proposed, and several areas for additional technical research are also suggested.
---
paper_title: Application of density-based outlier detection to database activity monitoring

paper_content:

To prevent internal data leakage, database activity monitoring uses software agents to analyze protocol traffic over networks and to observe local database activities. However, the large size of data obtained from database activity monitoring has presented a significant barrier to effective monitoring and analysis of database activities. In this paper, we present database activity monitoring by means of a density-based outlier detection method and a commercial database activity monitoring solution. In order to provide efficient computing of outlier detection, we exploited a kd-tree index and an Approximated k-nearest neighbors (ANN) search method. By these means, the outlier computation time could be significantly reduced. The proposed methodology was successfully applied to a very large log dataset collected from the Korea Atomic Energy Research Institute (KAERI). The results showed that the proposed method can effectively detect outliers of database activities in a shorter computation time.
---

Title: Guest editorial: A brief overview of data leakage and insider threats
Section 1: Introduction
Description 1: Introduce the challenges and complexities associated with preventing, detecting, and responding to data leakage and insider threats, and present key research questions.

Section 2: Defining and characterizing insider threats
Description 2: Discuss the various definitions and characteristics of insider threats, and explore different approaches (technical, social, socio-technical) to studying insider behavior and activity.

Section 3: Insider threat research overview
Description 3: Provide a historical overview of insider threat research, highlighting key organizations and researchers, as well as different methodologies used to study insider threats.

Section 4: Insider threats and data leakage
Description 4: Examine various types of data leakage crimes perpetrated by insiders, and discuss studies and reports on motivations, stages of data leakage, and methods to address these threats.

Section 5: Current issue
Description 5: Summarize the contributions of the papers in the current issue, focusing on different perspectives and proposed solutions to insider data leakage.