ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™

Motive

The reason or underlying cause that prompts a subject to engage in an infringement.

Boundary Testing Conflicts of Interest Curiosity Fear of Reprisals Hubris Human Error Ideology Lack of Awareness Misapprehension or Delusion Political or Philosophical Beliefs Recognition Resentment Revenge Rogue Nationalism Self Sabotage Third Party Collusion Motivated by Personal Gain

Means

The mechanisms or circumstances required for an infringement to occur.

Ability to Modify Cloud Resources Aiding and Abetting Bring Your Own Device (BYOD) Clipboard Delegated Access via Managed Service Providers FTP Servers Media Capture Network Attached Storage Physical Disk Access Privileged Access Screenshots and Screen Recording Sensitivity Label Leakage SMB File Sharing SSH Servers Unrestricted Software Installation

Preparation

The activities conducted by a subject to aid or enable an infringement.

Authorization Token Staging Boot Order Manipulation CCTV Enumeration File Download IT Ticketing System Exploration Joiner Mover Network Scanning Persistent Access via Bots Physical Disk Removal Physical Exploration Physical Item Smuggling Private / Incognito Browsing Read Windows Registry Social Engineering (Outbound) Software or Access Request Suspicious Web Browsing Testing Ability to Print VPN Usage

Infringement

The act that harms or undermines an organization.

Excessive Personal Use Exfiltration via Screen Sharing Harassment and Discrimination Non-Corporate Device Unauthorized VPN Client

Anti-Forensics

The actions undertaken by a subject to frustrate any subsequent investigation.

Decrease Privileges Delayed Execution Triggers Deletion of Volume Shadow Copy File Deletion File Encryption Log Modification Physical Removal of Disk Storage System Shutdown Timestomping Uninstalling Software Windows System Time Modification

593 knowledge objects. 10 recently added.