DoD employs about 3.5 million military and civilian direct employees, contractors, and reserve personnel. In addition, over 50,000 contracted entities (e.g., groups and organizations) can connect directly to the DoD Information Network (DoDIN) to collaborate and protect DoD systems and sensitive data. These imperfect users often interact with DoD across multiple classification domains and IT systems. Without focusing on potentially damaging insider activity, DoD will fail to meet the 2018 Cyber Strategy objectives, and adversaries will continue to erode our technical overmatch while imposing excessive remediation costs. This erosion occurs not only through attacks using technical means but also through exploitation of insiders. This article will introduce and urge the implementation of a framework to more effectively address insider threats by providing an empirical measure of each user's risk through their actual behaviors. This model will give the user near-real-time awareness of personal behaviors counter to organizational policy and cybersecurity requirements. This measure will also empower management to target training, remediation, and risk reduction while also allowing decision-makers to determine which user risk-exposed areas, roles, or practices require additional remediation. As a result, all organizational decision levels will be better able to improve cybersecurity resiliency in the face of an ever-evolving insider threat landscape.
FULL ARTICLE HERE