ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: AR1
  • Created: 22nd May 2024
  • Updated: 23rd July 2024

Motive

The reason or underlying cause that prompts a subject to engage in an infringement.

Sections

ID Name Description
MT012Coercion

A subject is persuaded against their will to access and exfiltrate or destroy sensitive data, or conduct some other act that harms or undermines the target organization. 

MT017Espionage

A subject carries out covert actions, such as the collection of confidential or classified information, for the strategic advantage of a nation-state.

MT009Fear of Reprisals

A subject accesses and exfiltrates or destroys sensitive data or otherwise contravenes internal policies in an attempt to prevent professional reprisals against them or other persons.

MT011Hubris

A subject accesses and exfiltrates or destroys sensitive data or otherwise contravenes internal policies with the aim to successfully defeat controls in order to demonstrate ability and/or skill.

MT016Human Error

The subject has no threatening motive and is not reckless in their actions. The infringement is a result of an honest mistake made by the subject.

MT001Joiner

A subject joins the organisation with the pre-formed intent to gain access to sensitive data or otherwise contravene internal policies.

MT008Lack of Awareness

A subject is unaware that they are prohibited from accessing and exfiltrating or destroying sensitive data or otherwise contravening internal policies.

MT003Leaver

A subject leaving the organisation with access to sensitive data with the intent to access and exfiltrate sensitive data or otherwise contravene internal policies.

MT013Misapprehension or Delusion

A subject accesses and exfiltrates of destroys sensitive data or otherwise contravenes internal policies as a result of motives not grounded in reality.

MT002Mover

A subject moves within the organisation to a different team with the intent to gain access to sensitive data or to circumvent controls or to otherwise contravene internal policies.

MT005Personal Gain

A subject seeks personal gain from another by accessing and exfiltrating or destroying sensitive data or otherwise contravening internal policies.

MT004Political or Philosophical Beliefs

A subject is motivated by their political or philosophical beliefs to access and destroy or exfiltrate sensitive data or otherwise contravene internal policies.

MT015Recklessness

The subject does not have a threatening motive. However, the subject under takes actions without due care and attention to the outcome, which causes an infringement.

MT007Resentment

A subject is motivated by resentment towards the organisation to access and exfiltrate or destroy data or otherwise contravene internal policies. 

MT010Self Sabotage

A subject accesses and exfiltrates or destroys sensitive data or otherwise contravenes internal policies with the aim to be caught and penalised.

MT006Third Party Collusion Motivated by Personal Gain

A subject is recruited by a third party to access and exfiltrate or destroy sensitive data or otherwise contravene internal policies for in exchange for a personal gain.