search menu icon-carat-right cmu-wordmark

Insider Threat Blog

Real-World Work Combating Insider Threats

Latest Posts

InTP Series: Confidential Reporting (Part 9 of 18)

InTP Series: Confidential Reporting (Part 9 of 18)

• Insider Threat Blog
CERT Insider Threat Center

"If you see something, say something." That phrase has been a popular security slogan for some time, and it applies to insider threat as well as other security arenas. Organizations need to develop a robust reporting capability that their employees can use because they may observe concerning behaviors and dispositions that technical controls might miss. Hi, this is David McIntire of the CERT Insider Threat Center. In this installment of our blog series on establishing...

Read More
InTP Series: Training and Awareness (Part 8 of 18)

InTP Series: Training and Awareness (Part 8 of 18)

• Insider Threat Blog
CERT Insider Threat Center

The cornerstones of any insider threat program (InTP) are a formal training and awareness curriculum and a defined set of educational activities. A successful InTP requires multiple levels of training for different parts of the organization and different types of employees. Of course, any training program should fit within the mission and culture of the implementing organization and should leverage existing expertise and processes. Hi, this is Robin Ruefle, team lead of the Organizational Solutions...

Read More
InTP Series: Prevention, Detection, and Response (Part 7 of 18)

InTP Series: Prevention, Detection, and Response (Part 7 of 18)

• Insider Threat Blog
CERT Insider Threat Center

The underlying network infrastructure is a critical component of any insider threat program. In this seventh in a series of 18 posts, I will introduce a few concepts of how to use your enterprise infrastructure to prevent, detect, and respond to insider threat events. My name is Derrick Spooner, a member of the technical staff of the CERT Insider Threat Center in the Software Engineering Institute (SEI) at Carnegie Mellon University. Previous posts have introduced...

Read More
 InTP Series: Oversight of Program Compliance and Effectiveness (Part 5 of 18)

InTP Series: Oversight of Program Compliance and Effectiveness (Part 5 of 18)

• Insider Threat Blog
CERT Insider Threat Center

Why should anyone care about program compliance and effectiveness? The CERT Division's answer to this question is simple: If you're going to have an Insider Threat Program (InTP), you want it to work well and within the limits of the law. We advocate that InTPs comply with all applicable laws, regulations, policies, and established procedures in a way that effectively deters, detects, and mitigates insider threats. Be sure to regularly work with your organization's general...

Read More
InTP Series: Participation of Business Areas (Part 4 of 18)

InTP Series: Participation of Business Areas (Part 4 of 18)

• Insider Threat Blog
CERT Insider Threat Center

An effective Insider Threat Program includes participation from the essential business areas of an organization. The National Insider Threat Task Force (NITTF) Minimum Standards identify the particular groups that should be represented in an insider threat program. Hi, this is Mike Albrethsen of the CERT Insider Threat Center with information about which groups should be included in the operation of an effective InTP and why. These are the groups that the NITTF recommends participate in...

Read More
 InTP Series: The Formalized Program (Part 3 of 18)

InTP Series: The Formalized Program (Part 3 of 18)

• Insider Threat Blog
CERT Insider Threat Center

Hi, I'm Matt Collins, an Insider Threat Researcher at the CERT Insider Threat Center. This week in the third installment of our series, we'll take a look at the first component of an insider threat program: the formalized program itself. In last week's post, I summarized the elements of a successful insider threat program. Why a formalized program? A formalized insider threat program demonstrates the commitment of the organization to due care and due diligence...

Read More
InTP Series: Key Elements of an Insider Threat Program (Part 2 of 18)

InTP Series: Key Elements of an Insider Threat Program (Part 2 of 18)

• Insider Threat Blog
CERT Insider Threat Center

Before establishing an insider threat program in your organization, you first must understand the required components of such a program. In this second of a series of 18 posts, I will introduce you to the elements of an effective insider threat program. Hi, I'm Matt Collins, an Insider Threat Researcher at the CERT Insider Threat Center. In the previous post, Randy Trzeciak discussed CERT insider threat work and reasons why an organization might want to...

Read More