The role of behavioral research and profiling in malicious cyber insider investigations

This article reviews recent empirical evidence garnered from inductive studies of insiders examining "who, what, where, when, why and how" of insider computer attacks. These results are then compared to insider "theories" and folklore. Then the use of a specific deductive profiling approach to insider investigation and case management is described along with illustrative case studies. The overall role of the behavioral consultant in insider cases is examined with emphasis on specific forms of support for the investigative team and aid to managers and security personnel with case management of insiders within corporate environments.