A research project at the CERT® Program is identifying enterprise architectural patterns to protect against the insider threat to organizations. This paper presents an example of such a pattern---Increased Monitoring for Intellectual Property (IP) Theft by Departing Insiders---to help organizations plan, prepare, and implement a means to mitigate the risk of insider theft of IP. Our case data shows that many insiders who stole IP did so within 30 days of their termination. Based on this insight, this pattern helps reduce that risk through increased monitoring of departing insiders during their last 30 days of employment. The increased monitoring suggested by the pattern is above and beyond what might be required for a baseline organizational detection of potentially malicious insider actions. Future work will develop a library of enterprise architectural patterns for mitigating the insider threat based on the data we have collected. Our goal is for organizational resilience to insider threat to emerge from repeated application of patterns from the library.

Insider threat research at the CERT Program has shown that many organizations fall into a vicious cycle of trust and insider threat: organizations do not detect any suspicious insider behavior, so they trust their insiders, do not monitor them, and consequently do not detect suspicious insider behavior. This paper presents a pattern that can break this vicious cycle.

A formal method for decomposing the critical requirements of a system into requirements of its component processes and a minimal, possibly empty, set of synchronization requirements is described. The trace model of Hoare's communicating sequential processes (CSP) is the basis for the formal method. The method is applied to an abstract voice transmitter and describes the role that the EHDM verification system plays in the transmitter's decomposition is described. In combination with other verification techniques, it is expected that this method will promote the development of more trustworthy systems.>

This paper describes a Gypsy[l] realization of a formal security policy model and top level specification for a secure, multi-level loud area network (LAN). The network, which is being developed by the Verdix Corporation of Chantilly, Virginia, is one of the fmt network products to be accepted for developmental evaluation by the Computer Security Center leading to, we hope, an eventual certification at the A-1 level. Because network criteria are still undergoing development, the LAN will be evaluated under the TCSEC [2] criteria for multi-level secure computer systems. The remainder of the paper briefly describes the LAN itself, the policy model and its Gypsy representation,and FTLS. This is followed by a discussion of related issues such as covert channel analysis. The conclusions will cover both the applicability of the TCSEC criteria to network products such as this and the use of such products as building blocks for distributed semre systems.