Inside Payback: Using Metrics to Demonstrate Insider Risk Program Value
summary
Organization has analyzed about 4,000 insider incidents and publishes 120+ reports; examples include a demoted engineer stealing >$1B in IP, DMV staff selling 200 fake IDs for >$1M, 800,000 liters of sewage released, and 9-1-1 disruption. Recommendations include starting small (focus on one threat category), building a data analytic hub that combines technical and behavioral sources, using Goal‑Question‑Indicator‑Metric to tie metrics to strategy, and benchmarking with DHS CISA/CERT tools while tracking program maturity from nascent to mature.
AI-written summary · about
chapters (12)
- 0:00Insider risk program journey
- 1:04Delivering program value
- 2:50Insider threat research foundations
- 5:15Key program components
- 8:26Formal program building
- 12:14Metrics development tools
- 18:42GQIM process for effectiveness
- 25:22Measuring program effectiveness
- 28:14Return on investment
- 33:29Program maturity evaluation
- 38:22Program lifecycle improvement
- 39:26Q&A
related talks
54mInsider Threats and New Economy Industries
48mStop Chasing Insider Threats, Start Managing Insider Risk
20mIntriguing Insider Threat Cases - Make Sure This Doesn't Happen to You!
41mCollaboration Without Data Loss: Keep IP From Leaking to Competitors
15mPredictive Techniques to Catch Insider Threats Before they Become Criminals
40mA Data Protection Problem: Insider Risk
55mDeveloping a Conceptual Model for Insider Threat
15mFrom Risk to Return: Measuring Cybersecurity ROI with Data Analytics