ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

Motive

The reason or underlying cause that prompts a subject to engage in an infringement.

Curiosity Espionage Fear of Reprisals Hubris Human Error Joiner Lack of Awareness Leaver Misapprehension or Delusion Mover Political or Philosophical Beliefs Recklessness Resentment Rogue Nationalism Self Sabotage Third Party Collusion Motivated by Personal Gain

Means

The mechanisms or circumstances required for an infringement to occur.

Aiding and Abetting Asset Control Bring Your Own Device (BYOD) Clipboard FTP Servers Intellectual Property Theft Media Capture Network Attached Storage Physical Disk Access Privileged Access Screenshots SMB File Sharing SSH Servers Unrestricted Software Installation

Preparation

The activities conducted by a subject to aid or enable an infringement.

Boot Order Manipulation CCTV Enumeration File Download Increase Privileges IT Ticketing System Exploration Network Scanning Physical Disk Removal Physical Exploration Physical Item Smuggling Private / Incognito Browsing Read Windows Registry Social Engineering (Outbound) Suspicious Web Browsing Testing Ability to Print

Infringement

The act that harms or undermines an organization.

Excessive Personal Use Harassment and Discrimination Non-Corporate Device Unauthorized VPN Client

Anti-Forensics

The actions undertaken by a subject after infringement to frustrate any subsequent investigation.

Decrease Privileges Deletion of Volume Shadow Copy File Deletion File Encryption Log Tampering Physical Removal of Disk Storage Steganography System Shutdown Timestomping Uninstalling Software Use of a Virtual Machine