ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

Motive

The reason or underlying cause that prompts a subject to engage in an infringement.

Boundary Testing Conflicts of Interest Curiosity Espionage Fear of Reprisals Hubris Human Error Ideology Joiner Lack of Awareness Leaver Misapprehension or Delusion Mover Political or Philosophical Beliefs Resentment Rogue Nationalism Self Sabotage Third Party Collusion Motivated by Personal Gain

Means

The mechanisms or circumstances required for an infringement to occur.

Ability to Modify Cloud Resources Aiding and Abetting Asset Control Bring Your Own Device (BYOD) Clipboard FTP Servers Media Capture Network Attached Storage Physical Disk Access Privileged Access Screenshots Sensitivity Label Leakage SMB File Sharing SSH Servers Unrestricted Software Installation

Preparation

The activities conducted by a subject to aid or enable an infringement.

Boot Order Manipulation CCTV Enumeration File Download IT Ticketing System Exploration Network Scanning Physical Disk Removal Physical Exploration Physical Item Smuggling Private / Incognito Browsing Read Windows Registry Social Engineering (Outbound) Software or Access Request Suspicious Web Browsing Testing Ability to Print

Infringement

The act that harms or undermines an organization.

Excessive Personal Use Harassment and Discrimination Non-Corporate Device Unauthorized VPN Client

Anti-Forensics

The actions undertaken by a subject to frustrate any subsequent investigation.

Decrease Privileges Deletion of Volume Shadow Copy File Deletion File Encryption Log Tampering Physical Removal of Disk Storage System Shutdown Timestomping Uninstalling Software Use of a Virtual Machine Windows System Time Modification