search menu icon-carat-right cmu-wordmark

Insider Threat Blog

Real-World Work Combating Insider Threats

Latest Posts

InTP Series: Implementation Planning (Part 17 of 18)

InTP Series: Implementation Planning (Part 17 of 18)

• Insider Threat Blog
CERT Insider Threat Center

Implementation plans are an essential component of developing an Insider Threat Program (InTP). It is important to look at the development of an implementation plan from a strategic long-term perspective. Hello, this is Tracy Cassidy, Insider Threat Researcher at the CERT Insider Threat Center. In this next-to-the-last blog post in our insider threat blog series, I'll provide an outline for developing an implementation plan....

Read More
InTP Series: The Insider Threat Framework (Part 16 of 18)

InTP Series: The Insider Threat Framework (Part 16 of 18)

• Insider Threat Blog
CERT Insider Threat Center

The single most important aspect of developing a successful insider threat program (InTP) framework is a clear vision. Therefore, it is imperative that you define your vision in a concept of operations document or charter. Hi, this is Jason W. Clark, Ph.D, an insider threat researcher with the CERT Insider Threat Center. In this blog post, I will briefly describe and define an InTP framework document....

Read More
 InTP Series: Protection of Employee Civil Liberties and Privacy Rights (Part 15 of 18)

InTP Series: Protection of Employee Civil Liberties and Privacy Rights (Part 15 of 18)

• Insider Threat Blog
CERT Insider Threat Center

The news today is buzzing with discussions regarding civil liberties and privacy rights. Insider threat program (InTP) development deals directly with these issues, specifically the protection of employees. It is essential that management to familiarize itself with existing mandates, statutes, laws, and directives that are related to InTP implementation. Hi, my name is Tracy Cassidy. I am an Insider Threat Researcher at the CERT Insider Threat Center. In this, the 15th of 18 posts in...

Read More
 InTP Series: Policies, Procedures, and Practices (Part 14 of 18)

InTP Series: Policies, Procedures, and Practices (Part 14 of 18)

• Insider Threat Blog
CERT Insider Threat Center

An InTP requires two sets of policies, procedures, and practices: one set describing the operation and components of the program and the other set describing insider threat program (InTP) activities. Hi, I'm Cindy Nesta of the CERT Insider Threat Center. In this 14th installment of the InTP Blog Series, I will provide you with a clear explanation of the policies, procedures, and practices that an InTP requires....

Read More
 InTP Series: Communicating Insider Threat Events (Part 13 of 18)

InTP Series: Communicating Insider Threat Events (Part 13 of 18)

• Insider Threat Blog
CERT Insider Threat Center

When building your organization's Insider Threat Program (InTP), be sure to clearly identify defined processes for communicating insider threat events and incidents. It is important to ensure that all affected parties are made aware of the situation. As we all know, clear, concise, detailed, and documented communication is valuable. Hi, I'm Cindy Nesta of the CERT Insider Threat Team. In this 13th installment of the InTP Series, I will touch on several things, including the...

Read More
 InTP Series: Incident Response Planning (Part 12 of 18)

InTP Series: Incident Response Planning (Part 12 of 18)

• Insider Threat Blog
CERT Insider Threat Center

Your incident response plan should cover the entire incident lifecycle, including processes for how incidents are detected, reported, contained, remediated, documented, and prosecuted (if applicable). Hello, this is Mark Zajicek at the CERT Insider Threat Center. In this week's blog post, I summarize some guidance and suggest considerations to help you to develop an insider incident response plan....

Read More
 InTP Series: Data Collection and Analysis (Part 11 of 18)

InTP Series: Data Collection and Analysis (Part 11 of 18)

• Insider Threat Blog
CERT Insider Threat Center

A core capability of any insider threat program (InTP) involves collecting data from multiple sources and analyzing that data to identify indicators of insider anomalous activity or an increase in the probability of future insider activity. This is Dan Costa, a cybersecurity solutions developer at the CERT Insider Threat Center. This week, in the eleventh installment of the InTP blog series, I'll present strategies for increasing the effectiveness of an InTP's data collection and analysis...

Read More
InTP Series: Trusted Business Partners (Part 10 of 18)

InTP Series: Trusted Business Partners (Part 10 of 18)

• Insider Threat Blog
CERT Insider Threat Center

In today's business environment, few organizations are able to operate without contractors, subcontractors, temporary employees, contract employees, or other trusted business partners. Understanding how they fit into your insider threat program (InTP) and how to manage your organization's relationships with trusted business partners is critical to protecting your organization's data, assets, and reputation. Hi, this is Ian McIntyre of the CERT Insider Threat Center. In this 10th installment of our blog series on establishing an...

Read More