A preliminary model of insider theft of intellectual property

Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications

Volumn 2, Issue 1, 2011, Pages 28-49

  Moore, Andrew P ^a   Cappelli, Dawn M ^a   Caron, Thomas C ^b   Shaw, Eric ^c   Spooner, Derrick ^a   Trzeciak, Randall F ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b Deloitte Consulting   (United States)

^c Consulting and Clinical Psychology Ltd ^*  (United States)

Author keywords

Information security; Insider threat; Modeling; System dynamics; Theft of information; Theft of intellectual property

Indexed keywords

EID: 84855181760     PISSN: 20935374     EISSN: 20935382     Source Type: Journal    
DOI: None     Document Type: Article

References (27)

1. E. Rich, I. Martinez-Moyano, S. Conrad, D. Cappelli, A. Moore, and T. S. et.al., "Simulating insider cyberthreat risks: A model-based case and a case-based model," in Proc. of the 23rd International Conference of the System Dynamics Society, Boston, USA. System Dynamics Society, July 2005.
2. D. Capelli, L. Fischer, A. Moore, E. Shaw, and R. Trzeciak, "Common sense guide to prevention and detection of insider threat (3rd ed.)," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA, Tech. Rep., September 2008.
3. J. Predd, S. Pfleeger, J. Hunker, and C. Bulford, "Insiders behaving badly," IEEE Security and Privacy, vol. 6, no. 4, pp. 66-70, July/August 2008.
4. P. Sackett, "The structure of counterproductive work behaviors: Dimensionality and relationships with facets of job performance," International Journal of Selection and Assessment, vol. 10, pp. 5-11, 2002.
5. P. Sackett and C. Devore, "Counterproductive behaviors at work," in Handbook of Industrial, Work and Organizational Psychology, N. Anderson, D. Ones, H. Sinangil, and C. Viswesvaran, Eds. New York, NY: Sage Publications, Ltd., 2001, pp. 145-164.
6. D. Anderson, D. Cappelli, J. Gonzalez, M. Mojahedzdeh, A. Moore, E. Rich, and et.al., "Preliminary system dynamics maps of the insider cyber-threat problem," in Proc. of the 22nd International Conference of the System Dynamics Society, Keble College, Oxford, UK. System Dynamics Society, July 2004.
7. A. Moore, D. Cappelli, and R. Trzeciak, "The'big picture' of insider it sabotage across U.S. Critical Infrastructures," in Insider Attack and Cyber Security: Beyond the Hacker, S. Stolfo, S. Bellovin, S. Hershkop, A. Keromytis, S. Sinclair, and S. Smith, Eds. New York, NY: Springer Science+Business Media, LLC, 2008, pp. 17-52.
8. D. Cappelli, A. Desai, A. Moore, T. Shimeall, E. Weaver, and B. Willke, "Management and ducation of the risk of insider threat (MERIT): Mitigating the risk of sabotage to employers' information, systems, or networks," in Proc. of the 24th International Conference of the System Dynamics Society, Nijmegen, The Netherlands. System Dynamics Society, July 2006.
9. J. Salgado, "The big five personality dimensions and counterproductive behaviors," International Journal of Selection and Assessment, vol. 10, pp. 117-125, 2002.
10. M. Mount, R. Ilies, and E. Johnson, "Relationship of personality traits and counterproductive work behaviors: The mediating effects of job satisfaction," Personnel Psychology, vol. 59, pp. 591-622, 2006.
11. C. Stamper and S. Masterson, "Insider or outsider? how employee perceptions of insider status affect their work behavior," Journal of Organizational Behavior, vol. 23, no. 8, pp. 875-894.
12. D. Parker, Fighting Computer Crime: A New Framework for Protecting Information. New York: John Wiley and Sons, 1998.
13. B. Wood, "An insider threat model for adversary simulation," in Proc. for Research on Mitigating the Insider Threat to Information Systems. The RAND Corporation, August 2000.
14. J. Suler and W. Phillips, "The bad boys of cyberspace: Deviant behavior in multimedia chat communities," CyberPsychology and Behavior, vol. 1, pp. 275-294, 1998.
15. E. Shaw, K. Ruby, and J. Post, "The insider threat to information systems: The psychology of the dangerous insider," Security Awareness Bulletin, no. 2-98, pp. 27-46, 1998.
16. E. Spafford, "A framework for understanding and predicting insider attacks," Computers and Security, vol. 21, no. 6, pp. 526-531, October 2002.
17. T. Gudaitis, "The missing link in information security: Three dimensional profiling," Cyber Psychology and Behavior, vol. 1, no. 4, pp. 321-340, 1998.
18. S. Band, D. Cappelli, L. Fischer, A. Moore, E. Shaw, and R. Trzeciak, "Comparing insider IT sabotage and espionage: A model-based analysis," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA, Tech. Rep. CMU/SEI-2006-TR-026, December 2006.
19. L. Fischer, "Characterizing information systems insider offenders," in Proc. of the 45th Annual Conference of the International Military Testing Association (IMTA'03), Jason Cope, UK, 2003.
20. K. Herbig and M. Wiskoff, "Espionage against the United States by American citizens 1947-2001," Defense Personnel Security Research Center, Monterrey, CA, Tech. Rep. PERSEREC-TR-02-5, July 2002.
21. E. Shaw and L. Fischer, "Ten tales of betrayal: The threat to corporate infrastructure by information technology insiders," Defense Personnel Security Research Center, Monterrey, CA, Tech. Rep. PERSEREC-TR-0513, September 2005.
22. D. Caputo, G. Stephens, and M. Maloof, "Detecting insider theft of trade secrets," IEEE Security and Privacy, vol. 7, no. 6, pp. 14-21, November/December 2009.
23. R. Yin, Case Study Research (4th ed.). Thousand Oaks, CA: Sage Publications, 2009.
24. J. D. Sterman, Business Dynamics: Systems Thinking and Modeling for a Complex World. New York, NY: McGraw-Hill, 2000.
25. M. Sastry, "Analyzing the research on self reinforcing processes in organizations: Another approach to archetypes," in Proc. of the 16th International Conference of the System Dynamics Society, Quebec City, Canada. System Dynamics Society, July 1998.
26. B. Staw and J. Ross, "Understanding behavior in escalation situations," Science, vol. 246, no. 4927, pp. 216-220.
27. M. McCormick, "Data theft: A prototypical insider threat," in Insider Attack and Cyber Security: Beyond the Hacker, S. Stolfo, S. Bellovin, S. Hershkop, A. Keromytis, S. Sinclair, and S. Smith, Eds. New York, NY: Springer Science+Business Media, LLC, 2008, pp. 53-68.