search menu icon-carat-right cmu-wordmark

Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis

Technical Report
In this report, the authors examine the psychological, technical, organizational, and contextual factors that contribute to espionage and insider sabotage.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2006-TR-026
DOI (Digital Object Identifier)
10.1184/R1/6572663.v1

Abstract

This report examines the psychological, technical, organizational, and contextual factors thought to contribute to at least two forms of insider trust betrayal: insider sabotage against critical information technology (IT) systems, and espionage. Security professionals and policy leaders currently view espionage and insider threat as serious problems but often as separate issues that should be each addressed by a different configuration of security countermeasures. In this study, researchers investigated similarities and differences between insider IT sabotage and espionage cases to isolate the major factors or conditions leading to both categories of trust betrayal. The team developed a descriptive model using the system dynamics methodology that represents the high-level commonalities between the two domains based on models of the individual domains. The effort found definite parallels between the two categories of trust betrayal. Factors observed in both saboteurs and spies include " the contribution of personal predispositions and stressful events to the risk of an insider committing malicious acts " the exhibition of behaviors and technical actions of concern by the insider preceding or during an attack " the failure of their organizations to detect or respond to rule violations " the insufficiency of the organization's physical and electronic access controls. Based on the study's findings and analysis, recommendations and policy implications are also presented.

Cite This Technical Report

Band, S., Cappelli, D., Fischer, L., Moore, A., Shaw, E., & Trzeciak, R. (2006, December 1). Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis. (Technical Report CMU/SEI-2006-TR-026). Retrieved May 18, 2024, from https://doi.org/10.1184/R1/6572663.v1.

@techreport{band_2006,
author={Band, Stephen and Cappelli, Dawn and Fischer, Lynn and Moore, Andrew and Shaw, Eric and Trzeciak, Randall},
title={Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis},
month={Dec},
year={2006},
number={CMU/SEI-2006-TR-026},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6572663.v1},
note={Accessed: 2024-May-18}
}

Band, Stephen, Dawn Cappelli, Lynn Fischer, Andrew Moore, Eric Shaw, and Randall Trzeciak. "Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis." (CMU/SEI-2006-TR-026). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, December 1, 2006. https://doi.org/10.1184/R1/6572663.v1.

S. Band, D. Cappelli, L. Fischer, A. Moore, E. Shaw, and R. Trzeciak, "Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2006-TR-026, 1-Dec-2006 [Online]. Available: https://doi.org/10.1184/R1/6572663.v1. [Accessed: 18-May-2024].

Band, Stephen, Dawn Cappelli, Lynn Fischer, Andrew Moore, Eric Shaw, and Randall Trzeciak. "Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis." (Technical Report CMU/SEI-2006-TR-026). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Dec. 2006. https://doi.org/10.1184/R1/6572663.v1. Accessed 18 May. 2024.

Band, Stephen; Cappelli, Dawn; Fischer, Lynn; Moore, Andrew; Shaw, Eric; & Trzeciak, Randall. Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis. CMU/SEI-2006-TR-026. Software Engineering Institute. 2006. https://doi.org/10.1184/R1/6572663.v1