Work

Insider Threat Control: Using Centralized Logging to Detect Data Exfiltration Near Insider Termination

Year: 2011

Type: article

Abstract: Since 2001, the CERT Insider Threat Center has built an extensive library and comprehensive database containing more than 600 cases of crimes committed against organizations by insiders. A significant class of insider crimes, insider theft of intellectual property, involves highly damaging attacks against organizations that result in significant tangible losses in the form of stolen business plans, customer lists, and other proprietary information. The Insider Threat Center's behavioral modeling of insiders who steal intellectual property shows that many insiders who stole their organization's intellectual property stole at least some of it within 30 days of their termination. This technical note presents an example of an insider threat pattern based on this insight. It then presents an example implementation of this pattern on an enterprise-class system using the centralized log storage and indexing engine Splunk to detect malicious insider behavior on a network.

DOI: 10.1184/r1/6574472.v1

Authors: Hanley, Michael, Montelibano, Joji

Institution: Carnegie Mellon University

Language: English

Topic: Information and Cyber Security

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

SDG: Peace, justice, and strong institutions

Open Access status: green

Funders: U.S. Department of Defense, U.S. Department of Homeland Security, Carnegie Mellon University

Awards: G116927039, G5926907248