The CERT® Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud)

Appendix D. Insider Threat Database Structure

Since 2001, we have been collecting incidents of malicious insider activity that occurred in U.S. organizations. In each of those incidents, the insider was found guilty in a U.S. court of law. To date, we have collected more than 700 cases of insider IT sabotage, fraud, theft of intellectual property, and national security espionage. This data provides the foundation for all of our insider threat research, work in our lab, assessments, workshops, and exercises.

We record actual insider incidents, providing a behavioral and technical framework for characterizing insider activity and analyzing incidents in a meaningful way that can be used to prevent, detect, and respond to insider threats. The recording ...