Insight into insiders and it: A survey of insider threat taxonomies, analysis, modeling, and countermeasures

Ivan Homoliak, Flavio Toffalini, Juan Guarnizo, Yuval Elovici, Martín Ochoa

ACM Computing Surveys (CSUR) 52 (2), 1-40, 2019

Insider threats are one of today’s most challenging cybersecurity issues that are not well addressed by commonly employed security solutions. In this work, we propose structural taxonomy and novel categorization of research that contribute to the organization and disambiguation of insider threat incidents and the defense solutions used against them. The objective of our categorization is to systematize knowledge in insider threat research while using an existing grounded theory method for rigorous literature review. The proposed categorization depicts the workflow among particular categories that include incidents and datasets, analysis of incidents, simulations, and defense solutions. Special attention is paid to the definitions and taxonomies of the insider threat; we present a structural taxonomy of insider threat incidents that is based on existing taxonomies and the 5W1H questions of the information gathering …