Topics in this Chapter:

• The Challenges of Detecting the Insider Threat

• Case Illustrations

Introduction

Columnist Jay Heiser recently drew the attention of the information security community to the need to better understand and incorporate Layer 8 the human layer of the Open Source Interconnection (OSI) Reference Model into security thinking. According to Heiser, The new and exciting infosecurity challenges don t require coders they require behavioral specialists (Heiser, 2004). For several years now, we have found that the best approach to security thinking in general, and especially, the assessment and management of a range of cyber attacks includes a broad repertoire of technical, security, legal, organizational, and behavioral science expertise. For example, whereas many cyber adversaries confine their attacks to code, others accompany their messages with verbal communications. These messages often play a vital role in efforts to obtain revenge, commit extortion, instill fear, or impress or coerce their targets. Others enjoy including political statements, justifications or other messages along with their attacks. This chapter describes a behavioral science tool we use to assess the verbal communications that often accompany these activities, including insider acts, anonymous threats, hacker extortion, cyber stalking, and other forms of cyber attacks.

The Challenges of Detecting the Insider Threat

Insiders remain one of the most potentially dangerous and difficult-to-detect threats to the integrity of U.S. government and corporate institutions. In the national security context, the individual insider s access to systems, information, resources and personnel make him, or her,...