Shaw, E. D., & Fischer, L. F. (2005). Ten Tales of Betrayal: The Threat to Corporate Infrastructure by Information Technology Insiders Analysis and Observations.
Eric Shaw and Lynn Fisher provide a review of ten cases of insider trust, examples of individuals for a number of mechanisms chose to lash out at their employer through an electronic weapon, and attempt to damage their employer. While these ten cases are varied in specifics, several core attributes and findings emerge.
The ten case studies selected come from non-DoD employers, in an attempt to apply this research to more than just military cases. However, the authors point out that when subcontracted personnel are hired to administer unclassified but critical government systems, not much is known about their background and their ability to hold a position of trust. As a result, these individuals may be more prone to insider attacks, as we will discuss. Mechanisms to prevent these attacks are discussed in this report, and are one of the main topics of this section. Insider threat prevention refers to both the policies and practices affecting employment screening, and to deter employee actions upon hiring.
Though this report focuses on human factors, it also provides consideration for technical security controls. However, the authors are quick to point out that 9 out of the 10 insiders studied used some mechanism to circumvent operational security, including computer security controls. The conclusion is that the sophistication of these attacks indicates the malicious insiders would have the skills, knowledge, and privileges necessary to circumvent most technical security controls. (Shaw & Fischer, 2005, p. 14) In fact, the authors further point out that in several of the insider attacks, their online activity was the first sign of any discontent, and at that point it is already too late. Any automated monitoring tool will most likely trigger once the malicious activity has been performed, and will most likely have a high rate of false positives. (Shaw & Fischer, 2005, p. 28) However, research has been performed in this and Shaw and Stroz (2004) created a software program to capture a number of these psychological factors. These factors include psychological profiling algorithms, keywords, communication-characteristic matching, changes in psychological state, and alerting the appropriate individuals.
While there are some common themes in the attacks, there is not one reliable profile on which to base an identification of potential malicious insiders. This is supported by other authors such as Gudaitis (1998) that a single cyber-offender profile is difficult to formulate, and does not take on the same characteristics of other criminal profiles. (Shaw & Fischer, 2005, p. 3)
Though a reliable profile is difficult to identify, the authors put forward a concept of the “critical pathway”, a mechanism to identify the likelihood of an insider attack through analysis of at-risk characteristics. The critical pathway is meant to capture the insider’s characteristics, stressors, and interactions to determine a profile and establish a mechanism to identify increased risk. The critical pathway is very similar to system dynamics, though on a less complex scale. The critical pathway is shown in Figure 2:
This is build from previous work by Shaw (1998a, 1998b) that identifies the critical pathway and several characteristics that may contribute to the increased risk of insider threat. These include:
- A history of negative social and personal experiences.
- Lack of social skills and a propensity for social isolation. The lack of social skills increases the odds of malicious activities when communication breaks down and the insider is unable to communicate their frustrations.
- A sense of entitlement
- Ethical Flexibility
(Shaw & Fischer, 2005, p. 31)
The report concludes with a series of recommendations, but focuses on two that can primarily reduce the number of successful malicious insider attacks. Managers should review and enforce policies regarding termination procedures and remote access policies. These and other factors were addressed by the authors. The authors discovered significant delays in corrective management actions to address personnel issues. In some cases, such as The Thief, the supervisor was aware of general disgruntlement but not the source, mostly due to a lack of communication. As the supervisor intervened with The Thief, the discipline only further aggravated him, though he did not communicate the specific cause to his supervisor. In fact, the authors state “One of the most important findings of this research was that there was a window of opportunity for dealing with the personnel problems affecting these subjects.” (Shaw & Fischer, 2005, p. 41) Table 6 provides an overview of disgruntlement for the 10 cases, and demonstrates the specific window of opportunity:
(Shaw & Fischer, 2005, p. 13)
The authors also discuss termination, and how termination can influence insider’s decisions when choosing their action. In some cases users are still permitted remote access in to corporate resources after termination, in other cases they have been allowed to continue to use company services as a customer, thus enabling their continued insider activity. Other cases show that psychological issues with terminated employees may prompt malicious insider activity. If the organization was aware of ongoing psychological problems, appropriate steps could have been taken to possibly prevent the insider attack. Termination practices played a critical factor in 8 of the 10 cases reviewed. Figure 1 shows the length of time between termination and incident, showing there is no clear pattern of time period. (Shaw & Fischer, 2005, p. 18)
The authors also demonstrate that attackers tend to make use of systems they are familiar with. They may use familiar systems both as the target of attack, or as an intermediary hop to their true target. This was also supported by Wood (2002), and is a critical component to the information hording and open information exchange in this KAM. As individuals are more likely to use or abuse the systems they most closely associate, those are the systems they may be more likely to harm. Consider that when allowing interconnections across organizations, that targeted applications may not be the critical ones the application owner has in mind.
