An Empirical Approach to Identify Information Misuse by Insiders (Extended Abstract)

Rogue employees with access to sensitive information can easily abuse their access to engage in information theft. To help differentiate malicious from benign behavior, this study measures how participants, given a common search topic, seek information. This study uses double-blind procedures, a stratified sample, and carefully designed control and experimental conditions. We seek to validate previously identified network indicators (ELICIT), find new host-based behaviors, and consider other human attributes that affect the information-use of malicious insiders by comparing their behavior to equivalent non-malicious users.