1. Dr. Bruce Gabrielson Keynote

2.  Five years since the release of the first Insider Threat State of the Art Report ◦ In reality, it’s been almost 7 years since the data was current.  While many exciting changes and innovations have taken place since that time in a number of detection areas, we’ve still been hit with Manning, Snowden, and others less visible.  Newer tools are now available for general and focused monitoring plus models have been validated for predicting personal behavior.

3.  Personal Profiling ◦ The precursors and threat indicators of potential malicious insider activities often associated with unhappiness, ethical or practical lifestyle issues  Activity Profiling ◦ What an individual does in relation to their job function  Behavior Profiling ◦ Specific activities that are suspicious in nature

4.  Developed from actual instances and case studies ◦ These are often associated with ethical or practical lifestyle issues or developed by integrating employee data, including psychological or social data with audit data.  Profiling has been a primary focus of several research organizations over the past few years.

5.  People tend to perform their work in a particular way on a regular basis.  By segmenting job descriptions into unique areas of activity, graphic models can be developed. NormalAbnormal

6.  Primarily IA detectable suspicious activities related to hacking, masquerading, compromised credentials, exfiltration, bad behavior, etc. ◦ Use case examples compiled and published by NSA  Potentially detectable in near real time through audit data sequence analysis or other means ◦ Biometric analysis of keyboard profiling or mouse movements ◦ Multiple trusted remote login detection of compromised credentials

7.  Protecting data isn’t always the problem.  Sometimes it’s the software and capabilities that need protecting. ◦ In the tactical data collection world, is the user the same as the remote user who initially logged on? ◦ What happens if a trusted user is logged on and the system is suddenly compromised by an untrusted insider with malicious intent?

8. Questions? Contact information: Dr. Bruce Gabrielson bgabrielson@caci.com

10. Known attack use cases were compiled in this document.

11. Continuous Monitoring