Malicious Insider Threat Types – An Empirical Analysis

Malicious insider threats represent a particular challenge not only for defense, but also for research, as it is estimated there is a high number of unreported cases. Current taxonomies and typologies usually focus on specific aspects, such as goal or motivation, and tend to have tight boundaries. A number of malicious insider threat attack scenarios were identified in our research through qualitative interviews, enhanced with a game-based creative approach. The resulting data was used to develop a malicious insider threat typology in an empirical bottom-up approach. We developed an analysis scheme from existing taxonomies and typologies and used it in an empirical analysis of malicious insider roles and attack scenarios. We were able to identify eleven archetypes of malicious insider threats considering multiple facettes. This paper describes the analysis and the identified types.