From Workshop on Preventing, Detecting, and Responding to Malicious Insider Misuse.
Santa Monica, CA.
August, 1999.

This document is concerned with insider misuse. In particular, it characterizes the challenges of detecting and responding to insider misuse and analyzes how insider misuse differs from penetrations and other forms of misuse by outsiders. It considers primarily malicious insider misuse, but also examines what can correspondingly be done to address accidental insider misuse. It also considers the role of prevention insofar as it affects detection and response capabilities. It incidentally challenges a few of the common default assumptions, although that is only a byproduct of a secondary attempt to put the insider-misuse detection problem into a broader context in order to decompose the overall problem.

@inproceedings{pgn-misuse,
    AUTHOR = {Peter {G.} Neumann},
    TITLE = {The Challenges of Insider Misuse},
    BOOKTITLE = {Workshop on Preventing, Detecting, and Responding to Malicious Insider Misuse},
    YEAR = {1999},
    ADDRESS = {Santa Monica, {CA}},
    MONTH = {aug},
    URL = {http://www.csl.sri.com/papers/pgn-misuse/}
}

• pgn-misuse.html