Comparing Insider IT Sabotage and Espionage: A Model-Based Analysis

Parent SEI Program

CERT Program

Stephen R. Band
Dawn M. Cappelli
Lynn F. Fischer
Andrew P. Moore
Eric D. Shaw
Randall F. Trzeciak

Technical Report
CMU/SEI-2006-TR-026

PDF File

This report examines the psychological, technical, organizational, and contextual factors thought to contribute to at least two forms of insider trust betrayal: insider sabotage against critical information technology (IT) systems, and espionage. Security professionals and policy leaders currently view espionage and insider threat as serious problems but often as separate issues that should be each addressed by a different configuration of security countermeasures. In this study, researchers investigated similarities and differences between insider IT sabotage and espionage cases to isolate the major factors or conditions leading to both categories of trust betrayal. The team developed a descriptive model using the system dynamics methodology that represents the high-level commonalities between the two domains based on models of the individual domains.

The effort found definite parallels between the two categories of trust betrayal. Factors observed in both saboteurs and spies include

• the contribution of personal predispositions and stressful events to the risk of an insider committing malicious acts
• the exhibition of behaviors and technical actions of concern by the insider preceding or during an attack
• the failure of their organizations to detect or respond to rule violations
• the insufficiency of the organization’s physical and electronic access controls.

Based on the study’s findings and analysis, recommendations and policy implications are also presented.