Insider Threat Security Reference Architecture

The Insider Threat Security Reference Architecture, ITSRA, provides an enterprise wide solution to insider threat. The architecture consists of four security layers - Business, Information, Data, and Application. Organizations should deploy and enforce controls at each layer in order to address insider attacks. Each layer does not function in isolation or independently of other layers. Rather, the correlation of indicators and application of controls across all four layers forms the crux of this approach. Based on empirical data consisting of over 600 cases of insider crimes, insider attacks proved successful in inflicting damage when an organization failed to implement adequate controls in any of three security principles - authorized access, acceptable use, and continuous monitoring. The ITSRA draws from existing best practices and standards as well as from analysis of these cases to provide actionable guidance for organizations to improve their posture against the insider threat.