All books

Professional

Apps About Coach Log in Start reading

Quantitative Finance · Glossary

What is Insider threat, data-loss prevention?

Also known as: insider threat · data-loss prevention

Definition 29.8 Research, Data and Risk Platforms · Chapter 29 — Security

An insider threat is harm done by someone with legitimate access — an employee, a contractor — through theft, sabotage or negligence. Data-loss prevention is the set of controls that detect and block the movement of protected data out of the places it is allowed to be: copies to removable media, uploads, mail, and unusual volumes of reading.

Planted insiders flagged, out of twenty, against how much more than usual they read each day, at one false alarm a month per hundred people. A single-day threshold on a trailing baseline almost never sees them; a CUSUM on a baseline lagged by 60 days finds 12 of 20 at +20% a day and 19 of 20 at +30%. Data: fig_accessctl.py.
Figure 29.3. Planted insiders flagged, out of twenty, against how much more than usual they read each day, at one false alarm a month per hundred people. A single-day threshold on a trailing baseline almost never sees them; a CUSUM on a baseline lagged by 60 days finds 12 of 20 at +20% a day and 19 of 20 at +30%. Data: fig_accessctl.py.
One planted insider reading 30% more strategy code than usual from day 120. The CUSUM on the lagged baseline crosses its calibrated threshold on day 131; on the trailing baseline it just reaches its own threshold (11.2) on day 147, then falls back once the copying has entered the baseline. A clean person’s CUSUM (grey) stays near zero. Data: fig_accessctl.py.
Figure 29.4. One planted insider reading 30% more strategy code than usual from day 120. The CUSUM on the lagged baseline crosses its calibrated threshold on day 131; on the trailing baseline it just reaches its own threshold (11.2) on day 147, then falls back once the copying has entered the baseline. A clean person’s CUSUM (grey) stays near zero. Data: fig_accessctl.py.
Read in context →