Comprehensiveness of Response to Internal Cyber-Threat and Selection of Methods to Identify the Insider

Abstract

A range of international regulatory documents state the importance of counteracting insiders, especially cyber-insiders, in critical facilities and simultaneously providing complex protection, which includes technical, administrative and information protection. In that case the insider, who is familiar with the protection or information system, will be able to find vulnerabilities and weak points in the protection of the information system or control system. One of the most important aspects of the preventive measures against insiders is personnel checks using different techniques, including interviews, social network analysis, and local area network analysis. In the case of having limited financial resources, it is necessary to choose a technique from a checklist rationally.