search menu icon-carat-right cmu-wordmark

Pattern-Based Design of Insider Threat Programs

December 2014 Technical Note
Andrew P. Moore, Matthew L. Collins, Dave Mundie, Robin Ruefle, David McIntire

In this report, the authors describe a pattern-based approach to designing insider threat programs that could provide a better defense against insider threats.


Software Engineering Institute

CMU/SEI Report Number


DOI (Digital Object Identifier):


Despite the high impact of insider attacks, organizations struggle to implement effective insider threat programs. In addition to the mandate for all Department of Defense (DOD) and U.S. Government agencies to build such programs, approval of updates to the National Industrial Security Program Operating Manual regarding insider threat defense require thousands of contractors to have insider threat programs as part of their security defense. Unfortunately, according to the Insider Threat Task Force of the Intelligence and National Security Alliance (INSA) Cyber Council, many such organizations have no insider threat program in place, and most of the organizations that do have serious deficiencies. This report describes a pattern-based approach to designing insider threat programs that could, if further developed, provide a more systematic, targeted way of improving insider threat defense.