[Introduction to Incident Handling and Response] Alex is an incident handler for Tech-o-Tech Inc. and is tasked to identify any possible insider threats within his organization. Which of the following insider threat detection techniques can be used by Alex to detect insider threats based on the behavior of a suspicious employee, both individually and in a group?

Profiling is a technique used to detect insider threats by first establishing a baseline of normal behavior for users. This profile is created by observing and recording typical activities, such as login times, systems accessed, data transfer volumes, and types of applications used. This can be done for an individual user (their own historical norm) and for a group of peers (e.g., others in the same department). An insider threat is then detected when a user's current behavior significantly deviates from this established profile, indicating a potential anomaly that requires investigation.

A. behavioral analysis: While related, "profiling" is the more specific technique of creating the baseline model of behavior. Behavioral analysis is the broader process of examining behavior, which is done against the established profile.
B. Physical detection: This technique is limited to monitoring physical actions, such as unauthorized access to secure areas, and does not cover the digital behaviors typically associated with modern insider threats.
D. Mole detection: This is a highly specific subset of insider threat detection focused on identifying individuals planted by an external entity. It is not a general technique for all types of suspicious employee behavior.

1. Carnegie Mellon University

Software Engineering Institute (SEI). In the technical report A Data-Driven Approach to Insider Threat Detection: A New Method for Profiling User Behavior (CMU/SEI-2017-TR-006)

the authors state

"Our method profiles user behavior by building a model of normal activity for each user. We then use this model to detect anomalous behavior that could be indicative of an insider threat." (Page 1

Paragraph 2). This directly supports profiling as the technique for modeling normal behavior to detect threats.

DOI: https://doi.org/10.1184/R1/6583559.v1

2. National Institute of Standards and Technology (NIST). While not using the exact term "profiling" in this context

NIST Special Publication 800-53

under control AU-13 (Monitoring for Information Disclosure)

discusses the necessity to "monitor... for atypical usage" and "analyze outbound communications traffic... to detect anomalies." This process of defining "typical" to find the "atypical" is the core concept of profiling. (NIST SP 800-53 Rev. 5

Page 198).

3. Syracuse University

College of Engineering & Computer Science. In courseware for CIS 663: "Assurance Foundations

" insider threat detection methods are discussed. The concept of "User Behavior Profiling" is presented as a primary method where a system learns the normal patterns of users and flags deviations. This includes profiling both individual and group/role-based behaviors.