ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: AR4
  • Created: 22nd May 2024
  • Updated: 23rd July 2024

Infringement

The act that harms or undermines an organization.

Sections

ID Name Description
IF013Disruption of Business Operations

A subject affects availability or integrity or systems or data, resulting in operational disruption.

IF017Excessive Personal Use

A subject uses organizational resources, such as internet access, email, or work devices, for personal activities both during and outside work hours, exceeding reasonable personal use. This leads to reduced productivity, increased security risks, and the potential mixing of personal and organizational data, ultimately affecting the organization’s efficiency and overall security.

IF010Exfiltration Over Email

A subject uses electronic mail to exfiltrate data.

IF003Exfiltration Over Media Capture

A subject uses an external device, such as a mobile phone or camera, to record audio, photos, or video to capture media.

IF005Exfiltration Over Messaging Applications

A subject uses a messaging application to exfiltrate data through messages or uploaded media.

IF004Exfiltration Over Other Network Medium

A subject exfiltrates files through a network. A network can be an Internet Protocol (IP) network or other technology enabling the communication of data between two or more digital devices.

IF001Exfiltration Over Web Service

A subject uses an existing, legitimate external Web service to exfiltrate data

IF002Exfiltration via Physical Medium

A subject may exfiltrate data via a physical medium, such as a removable drive.

IF008Inappropriate Web Browsing

A subject accesses web content that is deemed inappropriate by the organization.

IF009Installing Unapproved Software

A subject installs unapproved software on a corporate device, contravening internal policies on acceptable use of company equipment.

IF016Misappropriation of Funds

A subject dishonestly makes false representations, fails to disclose information or abuses their access or position to make a financial gain and/or cause a loss to an organization. Methods to achieve this include unauthorized bank transfers, misuse of corporate cards, or creating fictitious invoices.

IF011Providing Access to a Unauthorized Third Party

A subject intentionally provides system or data access to a third party that is not authorized to access it.

IF012Public Statements Resulting in Brand Damage

A subject makes comments either in-person or online that can damage the organization's brand through association.

IF018Sharing on AI Chatbot Platforms

A subject interacts with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok), leading to the intentional or unintentional sharing of sensitive information.

IF015Theft

A subject steals an item or items belonging to an organization, such as a corporate laptop or corporate mobile phone.

IF014Unauthorized Changes to IT Systems

A subject makes changes to IT systems that have adverse effects and cause operational disruption.

IF006Unauthorized Printing of Documents

A subject exfiltrates information by printing it to paper or other physical medium.

IF007Unlawfully Accessing Copyrighted Material

A subject unlawfully accesses copyrighted material, such as pirated media or illegitimate streaming sites.