A Survey of Methods for Detecting Intentional Insider Threats Against Digital Systems

Insider threats are a serious problem in all organizations and continue to be an issue despite technological advances. Insider threats can undermine cybersecurity by subverting controls or exploiting weak systems. These subversions can be enabled by an inadequate security policy, poor policy implementation, or new attack innovations. This thesis identifies the tactics that can be used by an intentional insider threat to subvert policies, and examines whether sufficiently reliable tools and policies are available to prevent and detect this type of behavior. We conclude with policy and technical control recommendations.