Overview of the CERT Insider Threat Center

The objective of the CERT Insider Threat Center is to assist organizations in preventing, detecting, and responding to insider compromises. Figure 1-2 depicts the malicious insider at the start of the incident timeline, and the damage at the end of the timeline. Our ultimate goal is to help you prevent the insider from attacking. However, if he should decide to attack, our objective is to provide you with the understanding and solutions you need to detect the illicit activity as early in the timeline as possible. Unfortunately, some malicious insiders will succeed in their attack; in those cases we want to arm you with policies, practices, and technical measures so that you can respond to the attack as quickly as possible. Response measures include recovering from the attack, identifying the perpetrator, and implementing new measures for improved incident management in the future.