Data-Driven Cyber Indicators of Malicious Insider Threat
summary
Study uses 100 real employees tasked to find, collect and remove sensitive internal documents; analysis finds 24 exfiltration techniques (nine used mainly by malicious actors: phone photos, USBs, burner/personal email, unsanctioned cloud, SMB/FTP), 76 evasion techniques (steganography, encrypted ZIPs, automated scripts, file corruption, clearing history) and an n‑gram sequence search that yields 13 useful sequences out of 5 million — sequences help a little but combinations and early search/collection signals matter more, and odd work hours are not a reliable PRI.
AI-written summary · about
chapters (11)
- 0:00Insider threat research at MITRE
- 1:51Study background and risk indicators
- 4:00Evasion and exfiltration techniques
- 12:182021 behavioral experiment methodology
- 23:23Key findings on evasion and detection
- 24:06Remote versus on-premises risk indicators
- 26:31Behavioral sequences for risk detection
- 30:05Why external frameworks fail
- 31:08New MITRE Insider Threat Framework
- 33:34Insider risk program benefits
- 46:20Q&A
related talks
26mInsider Threats Packing Their Bags With Corporate Data
54mInsider Threats and New Economy Industries
31mThe Return of Hacktivism – The Insider
55mDeveloping a Conceptual Model for Insider Threat
20mIntriguing Insider Threat Cases - Make Sure This Doesn't Happen to You!
54mHacked in hours: Red team assessments unveiling vulnerabilities
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
40mA Data Protection Problem: Insider Risk