search menu icon-carat-right cmu-wordmark

Cloud Service Provider Methods for Managing Insider Threats: Analysis Phase I

November 2013 Technical Note
Greg Porter (Heinz College at Carnegie Mellon University)

In this report, Greg Porter documents preliminary findings from interviews with cloud service providers on their insider threat controls.

Publisher:

Software Engineering Institute

CMU/SEI Report Number

CMU/SEI-2013-TN-020

Abstract

In early 2013, researchers in the CERT® Insider Threat Center contacted commercial and government cloud service providers (CSPs) about participating in research to gain a preliminary understanding of implemented administrative and technical controls that they are using to identify and manage the threats posed by insiders. These CSP participants provided frank and meaningful insight about their insider threat management programs and enterprise security practices. This report contains the observations obtained from interviewing the CSP personnel who volunteered to participate as well as an analysis of CSP management of insider threat based on the information obtained in interviews, observations of implemented insider threat controls, and risk considerations.