Identifying at-risk employees: A behavioral model for predicting potential insider threats

Abstract

SummaryA model was developed to assess employees' behavioral manifestations of a number of psychological and personality predispositions that are hypothesized to indicate an increased risk of insider abuse. This psychosocial model is based on case studies and research literature on factors and correlates associated with behavioral precursors of individuals committing insider crimes. In many of these crimes, managers and other coworkers observed that the offenders had exhibited signs of stress, disgruntlement, or other issues, but no alarms were raised. Barriers to using such psychosocial indicators include the inability to recognize the signs and the failure to record the behaviors so that they can be assessed.The model has been implemented as a Bayesian belief network, designed with the help of human resources staff experienced in evaluating workplace behaviors. We conducted an experiment to assess the agreement of the model's risk assessment output with judgments of human resources and management professionals on the relative insider threat risks of a collection of sample scenarios. The model exhibited strong agreement with judgments of the human experts, suggesting that it has potential as a tool to raise an alarm about employees who pose higher insider threat risks. While additional testing is needed, we suggest that combining this type of analysis with more traditional cyber/workstation monitoring tools can ease the processing burden and improve performance of computer-assisted insider threat monitoring and detection.v

Predicting Insider Threat Risks through Linguistic Analysis of Electronic Communication

“…The results from this research were consistent with results obtained by the authors' collaborators using a similar approach that utilized a proprietary dataset containing messages from a similar number of individuals [3][4]. The current research employed greater automation, a larger sample of text that was available in the public domain, and additional analysis to identify which word categories had the greatest influence on factor scores.…”

“…This test did not produce the expected result as two of the known criminals actually used a relatively large number of agreeable words compared to the overall corpus. The authors' collaborators used a different approach in a separate study [3] and [4] analyzing messages for high frequencies of words negatively correlated with agreeableness. In that study, known criminals were found at the critical level for the agreeableness factor.…”

“…Legal, ethical/privacy and economic concerns limit the practicality of implementing organizational practices involving direct psychological examination [1][2] an alternative approach utilizing supervisor or coworker assessments has been described [3] but, again, some organizations may consider this practice to increase potential for organizational liability due to unfounded accusations. Greitzer et al [3][4] described an initial investigation of a new approach to psychological monitoring that analyzes electronic communications. The guiding philosophy is that the implementation of automated word analysis to derive psychosocial risk indicators in electronic communications maintains the advantages of behavioral monitoring while minimizing the above organizational risks.…”

“…The guiding philosophy is that the implementation of automated word analysis to derive psychosocial risk indicators in electronic communications maintains the advantages of behavioral monitoring while minimizing the above organizational risks. The present paper reports results of research that follows up on the initial investigation reported in [3] and [4] investigating the potential for active monitoring of electronic communications to identify insider threat risks early, allowing for proactive mitigation through coaching, assistance programs and where warranted, termination.…”

Modeling Human Behavior to Anticipate Insider Attacks

“…20 The indicators used in the model, such as disgruntlement, anger management issues, and disregard for authority, are shown in Figure 2. It is worth noting that these psychosocial indicators contribute differentially to the judged level of psychosocial risk, with disgruntlement, difficulty accepting feedback, anger management issues, disengagement, and disregard for authority having higher weights than other indicators, for example.…”