Tom Cross | Insider Threat Hunting for Authorized Evil | SOURCE Security Conference Boston 2013

Tom Cross | Insider Threat Hunting for Authorized Evil | SOURCE Security Conference Boston 2013 The prevalence of Insider Threat is often a subject of disagreement and unsourced statistical assertions. Many approaches to addressing the problem are both ineffective and overbearing at the same time. Complicating the issue as well is the need to detect the use of legitimate access credentials by external attackers. This talk will review academic research into Insider Threats, discussing the frequency and impact of the attacks and who does them and why. The talk will then cover strategies for managing the problem from both a business and technical point of view, discussing different techniques for identifying suspicious activity in large collections of data.