search menu icon-carat-right cmu-wordmark

Insider Threat Security Reference Architecture

Technical Report
In this report, the authors describe the Insider Threat Security Reference Architecture (ITSRA), an enterprise-wide solution to the insider threat.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2012-TR-007
DOI (Digital Object Identifier)
10.1184/R1/6574505.v1

Abstract

The Insider Threat Security Reference Architecture (ITSRA) provides an enterprise-wide solution to insider threat. The architecture consists of four security layers: Business, Information, Data, and Application. Organizations should deploy and enforce controls at each layer to address insider attacks. None of the layers function in isolation or independently of other layers. Rather, the correlation of indicators and application of controls across all four layers form the crux of this approach. Empirical data consisting of more than 700 cases of insider crimes show that insider attacks proved successful in inflicting damage when an organization failed to implement adequate controls in any of three security principles: authorized access, acceptable use, and continuous monitoring. The ITSRA draws from existing best practices and standards as well as from analysis of these cases to provide actionable guidance for organizations to improve their posture against the insider threat.

Cite This Technical Report

Montelibano, J., & Moore, A. (2012, April 1). Insider Threat Security Reference Architecture. (Technical Report CMU/SEI-2012-TR-007). Retrieved March 5, 2024, from https://doi.org/10.1184/R1/6574505.v1.

@techreport{montelibano_2012,
author={Montelibano, Joji and Moore, Andrew},
title={Insider Threat Security Reference Architecture},
month={Apr},
year={2012},
number={CMU/SEI-2012-TR-007},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6574505.v1},
note={Accessed: 2024-Mar-5}
}

Montelibano, Joji, and Andrew Moore. "Insider Threat Security Reference Architecture." (CMU/SEI-2012-TR-007). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, April 1, 2012. https://doi.org/10.1184/R1/6574505.v1.

J. Montelibano, and A. Moore, "Insider Threat Security Reference Architecture," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2012-TR-007, 1-Apr-2012 [Online]. Available: https://doi.org/10.1184/R1/6574505.v1. [Accessed: 5-Mar-2024].

Montelibano, Joji, and Andrew Moore. "Insider Threat Security Reference Architecture." (Technical Report CMU/SEI-2012-TR-007). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Apr. 2012. https://doi.org/10.1184/R1/6574505.v1. Accessed 5 Mar. 2024.

Montelibano, Joji; & Moore, Andrew. Insider Threat Security Reference Architecture. CMU/SEI-2012-TR-007. Software Engineering Institute. 2012. https://doi.org/10.1184/R1/6574505.v1