A Preliminary Model of Insider Theft of Intellectual Property

Abstract

A study conducted by the CERT ® Program at Carnegie Mellon University's Software Engineering Institute analyzed hundreds of insider cyber crimes across U.S. critical infrastructure sectors. Follow-up work involved detailed group modeling and analysis of 48 cases of insider theft of intellectual property. In the context of this paper, insider theft of intellectual property includes incidents in which the insider's primary goal is stealing confidential or proprietary information from the organization. This paper describes general observations about and a preliminary system dynamics model of this class of insider crime based on our empirical data. This work generates empirically-based hypotheses for validation and a basis for identifying mititgative measures in future work.

A Critical Reflection on the Threat from Human Insiders – Its Nature, Industry Perceptions, and Detection Approaches

“…There are several key features of this type of attack. First, the target tends to be product information, proprietary software and source code (these are clear targets in CMU-CERT studies [12]). Also, attacks appear more likely to be conducted by technical personnel (e.g., scientists and engineers) [6] and using technical means (54% of insiders used either email, remote access channel or network file transfer [11]) rather than physical theft of prototypes, for example.…”

“…Also, attacks appear more likely to be conducted by technical personnel (e.g., scientists and engineers) [6] and using technical means (54% of insiders used either email, remote access channel or network file transfer [11]) rather than physical theft of prototypes, for example. Finally, a majority of these thefts are committed by employees with legitimate access to the stolen IP; almost 75% stole material they had authorized access to [12]. Although 75% is a strong statistic and it is therefore very tempting to monitor only these individuals for this attack, yet as other articles have highlighted (e.g., the case of the foreign national who stole Ford secrets worth in excess of $50 million [13]), insiders with no legitimate access are also causing a great deal of harm.…”

“…Turner and Gelles [20], for instance, believe the following types of behavioural indicators need to be considered when examining insider risk: selfcentredness, arrogance, risk-taking, manipulativeness, coldness, self-deception and defensiveness. Others have suggested that insider threats score high on the personality traits that make up the 'Dark triad': narcissism, Machiavellianism and psychopathy [11,12,14,20]. The UK's Centre for the Protection of National Infrastructure (CPNI) have identified a number of other personality characteristics they believe are typical of an insider, including: immaturity, low self-esteem, amoral and unethical perspective, superficiality, proneness to fantasy, restlessness and impulsivity, and lack of conscientiousness [21].…”

Detecting threatening insiders with lightweight media forensics

“…We believe that there is a single distinguishing characteristic in many of these cases: as a preparation to exfiltrating data, insiders will collect it on a single system, typically a workstation under their control [2]. As such, the storage profile of this workstation changes in significant ways.…”

A Secure Data Encryption Method by Employing a Feedback Encryption Mechanism and Three-Dimensional Operation

“…Here feedback encryption is an encryption technique, in which a computational result of an encryption round R is fed back to the encryption mechanism for the next encryption round, i.e., Round R+1, as a part of (R+1)'s inputs, thereby increasing the unpredictability of ciphertext. The three-dimensional operation, referring to three different computations, includes an addition (+) [8,9], exclusive-or (⊕), and exclusive-and (⊙), when encrypting a plaintext block. The purpose is to increase the encryption complexity so as to reduce the probability of cracking the encryption process by hackers.…”