
Enjoy fast, free delivery, exclusive deals, and award-winning movies & TV shows with Prime
Try Prime
and start saving today with fast, free delivery
Amazon Prime includes:
Fast, FREE Delivery is available to Prime members. To join, select "Try Amazon Prime and start saving today with Fast, FREE Delivery" below the Add to Cart button.
Amazon Prime members enjoy:- Cardmembers earn 5% Back at Amazon.com with a Prime Credit Card.
- Unlimited Free Two-Day Delivery
- Streaming of thousands of movies and TV shows with limited ads on Prime Video.
- A Kindle book to borrow for free each month - with no due dates
- Listen to over 2 million songs and hundreds of playlists
- Unlimited photo storage with anywhere access
Important: Your credit card will NOT be charged when you start your free trial or if you cancel during the trial period. If you're happy with Amazon Prime, do nothing. At the end of the free trial, your membership will automatically upgrade to a monthly membership.
Buy new:
-19% $55.00$55.00
Ships from: Amazon.com Sold by: Amazon.com
Save with Used - Acceptable
$30.00$30.00
Ships from: Amazon Sold by: On the Go Reading

Download the free Kindle app and start reading Kindle books instantly on your smartphone, tablet, or computer - no Kindle device required.
Read instantly on your browser with Kindle for Web.
Using your mobile phone camera - scan the code below and download the Kindle app.
The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud) (SEI Series in Software Engineering) 1st Edition
Purchase options and add-ons
Since 2001, the CERT® Insider Threat Center at Carnegie Mellon University’s Software Engineering Institute (SEI) has collected and analyzed information about more than seven hundred insider cyber crimes, ranging from national security espionage to theft of trade secrets. The CERT® Guide to Insider Threats describes CERT’s findings in practical terms, offering specific guidance and countermeasures that can be immediately applied by executives, managers, security officers, and operational staff within any private, government, or military organization.
The authors systematically address attacks by all types of malicious insiders, including current and former employees, contractors, business partners, outsourcers, and even cloud-computing vendors. They cover all major types of insider cyber crime: IT sabotage, intellectual property theft, and fraud. For each, they present a crime profile describing how the crime tends to evolve over time, as well as motivations, attack methods, organizational issues, and precursor warnings that could have helped the organization prevent the incident or detect it earlier. Beyond identifying crucial patterns of suspicious behavior, the authors present concrete defensive measures for protecting both systems and data.
This book also conveys the big picture of the insider threat problem over time: the complex interactions and unintended consequences of existing policies, practices, technology, insider mindsets, and organizational culture. Most important, it offers actionable recommendations for the entire organization, from executive management and board members to IT, data owners, HR, and legal departments.
With this book, you will find out how to
- Identify hidden signs of insider IT sabotage, theft of sensitive information, and fraud
- Recognize insider threats throughout the software development life cycle
- Use advanced threat controls to resist attacks by both technical and nontechnical insiders
- Increase the effectiveness of existing technical security tools by enhancing rules, configurations, and associated business processes
- Prepare for unusual insider attacks, including attacks linked to organized crime or the Internet underground
By implementing this book’s security practices, you will be incorporating protection mechanisms designed to resist the vast majority of malicious insider attacks.
- ISBN-100321812573
- ISBN-13978-0321812575
- Edition1st
- PublisherAddison-Wesley Professional
- Publication dateJanuary 24, 2012
- LanguageEnglish
- Dimensions7 x 1.1 x 9.3 inches
- Print length432 pages
Frequently bought together

Customers who viewed this item also viewed
Editorial Reviews
Review
“For years, researchers at the CERT Insider Threat Center at Carnegie Mellon’s Software Engineering Institute have been collecting and studying data on real-world insider incidents. This year, they published a book cataloging the results of their research, called The CERT Guide to Insider Threats. This book is an invaluable guide to establishing effective processes for managing the risk of insider attacks, and it should be on every security professional’s wish list this year. In general, the insider threat drives home the point that perimeter defenses are no longer enough. IT organizations also need to be able to see into their internal networks to identify suspicious activity.”
-- Tom Cross, Director of Security Research at Lancope, guest writing for Forbes CIO Central
About the Author
Dawn Cappelli, CISSP, is Technical Manager of the CERT Insider Threat Center and the Enterprise Threat and Vulnerability Management Team at Carnegie Mellon University’s Software Engineering Institute (SEI). She has spent the past decade working with organizations such as the U.S. Secret Service and Department of Homeland Security in protecting the United States against insider threats. Andrew Moore is Lead Researcher in the CERT Insider Threat Center and Senior Member of Technical Staff at SEI. Randall Trzeciak is a Senior Member of Technical Staff at SEI, and Technical Team Lead for the Insider Threat Research Group at the CERT Insider Threat Center.
Product details
- Publisher : Addison-Wesley Professional; 1st edition (January 24, 2012)
- Language : English
- Hardcover : 432 pages
- ISBN-10 : 0321812573
- ISBN-13 : 978-0321812575
- Item Weight : 13.4 ounces
- Dimensions : 7 x 1.1 x 9.3 inches
- Best Sellers Rank: #330,222 in Books (See Top 100 in Books)
- #709 in Computer Security & Encryption (Books)
- #913 in Computer Science (Books)
- Customer Reviews:
About the author

Discover more of the author’s books, see similar authors, read book recommendations and more.
Customer reviews
- 5 star4 star3 star2 star1 star5 star64%19%17%0%0%64%
- 5 star4 star3 star2 star1 star4 star64%19%17%0%0%19%
- 5 star4 star3 star2 star1 star3 star64%19%17%0%0%17%
- 5 star4 star3 star2 star1 star2 star64%19%17%0%0%0%
- 5 star4 star3 star2 star1 star1 star64%19%17%0%0%0%
Customer Reviews, including Product Star Ratings help customers to learn more about the product and decide whether it is the right product for them.
To calculate the overall star rating and percentage breakdown by star, we don’t use a simple average. Instead, our system considers things like how recent a review is and if the reviewer bought the item on Amazon. It also analyzed reviews to verify trustworthiness.
Learn more how customers reviews work on AmazonTop reviews from the United States
There was a problem filtering reviews right now. Please try again later.
- Reviewed in the United States on December 31, 2012I've worked in security management for many years, and I currently teach related university classes. I find this book to be an invaluable addition to any business or security manager's professional book shelf.
Although its focus on academic rigor causes it to start a little slow, the rest of the book is well worth the wait. I plan to recommend this book to my students and to my readers.
Don't just think about buying this book... DO IT NOW!!!
- Reviewed in the United States on July 18, 2012The CERT Insider Threat Research center [...] has done a fantastic job of presenting relevant material with this book.
When I started reading the case studies, I had a hard time putting the book down. This is far from dry reading. I think it is great foundational reading for anyone who works in IT - new or seasoned. The threat landscape is an ever-changing landscape. I enjoyed reading the case studies and examples. Putting the reader in the shoes of the person committing the crime provides unique perspective that will help the reader identify and head off attacks.
The CERT Insider Threat Center has a very informative on its website (above). You can learn a lot by persuing the site. I like having the book as it puts everyting in a format I can take with me and the chapter layout makes sense.
Regardless of data classification, every company is at risk of sabotage or other threats, and I feel this book addressed the topics well.
- Reviewed in the United States on December 30, 2012If you think you don't have to think about security with your workers then you need to read this book. It has a realistic approach to common security issues from workers of your company as well as good approaches to minimizing the risk without costing a mint. Highly recommend it for security and non-security executives.
- Reviewed in the United States on October 23, 2013The authors have reviewed more than 700 cases of insider threat attacks and developed a comprehensive list of mitigation controls that might have prevented them. The book is not very well organized, but the content represents the authoritative source on precursor behavior that may illuminate potential insider attacks. In that regard, it is a must-read for cyber security professionals. What is clear from reading the book is that there is no technical solution that will prevent insider attacks. Technology can aid in discovery, but it is not a panacea; it will not prevent a determined inside attacker. A good program will accomplish four tasks:
1: Train employees and their managers to watch for the signs of potential insider threat behavior.
2: Provide the mechanisms across the organization to report and review the activity.
3: Establish and maintain the apparatus to report potential abuse and respond to incidents when necessary.
4: Mitigate the risk before any damage is done.
The key to the entire program is the human element, and that is why defending against the insider threat is hard.
Full review on my blog site: Terebrate
- Reviewed in the United States on April 18, 2012While Julius Caesar likely never said "Et tu, Brute?" the saying associated with his final minutes has come to symbolize the ultimate insider betrayal.
In The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, authors Dawn Cappelli, Andrew Moore and Randall Trzeciak of the CERT Insider Threat Center provide incontrovertible data and an abundance of empirical evidence, which creates an important resource on the topic of insider threats. There are thousands of companies that have uttered modern day versions of Et tu, Brute due to insidious insider attacks and the book documents many of them.
The book is based on work done at the CERT Insider Threat Center, which has been researching this topic for the last decade. The data the threat center has access to is unparalleled, which in turn makes this the definitive book on the topic. The threat center has investigated nearly 1,000 incidents and their data sets on the topic are unrivaled. With that, the book truly needs to be on the desktop of everyone tasked with data security and intellectual property protection.
The book provides a unique perspective on insider threats as the CERT Insider Threat Center pioneered the study of the topic, and has exceptional and empirical data to back up their findings. While there are many books on important security topics such as firewalls, encryption, identity management and more; The CERT Guide to Insider Threats is the one of the first to formally and effectively tackle the extraordinary devastating problem of trusted insiders who misappropriate data.
In the introduction, the authors write that a common misconception is that insider threat risk management is the responsibility of IT and information security staff members exclusively. The reality is that it is the responsibility of senior management to ensure that there is an overarching program to deal with insider threats at the enterprise level. Surpassingly and shockingly, far too few organizations have insider threat programs in place, and the book has scores of stories and case studies on those organizations that have become victims. While senior management created information security solutions to secure the perimeter; they were oblivious to the data leakage emanating from the interior network.
The authors reiterate that it is critical that all levels of management recognize and acknowledge the threat posed by insiders and take appropriate steps to mitigate malicious insiders. While it is impossible to stop every attack, what management can certainly do is build resiliency into their organizations infrastructure and business processes. This enables the organization to detect the attacks earlier and minimize the financial and operational impact. The book provides the specific details on how an organization can precisely do that.
In 9 detailed chapters and 6 appendices, the book provides a comprehensive and exhaustive analysis of the problem and menace of insider threats. After completing the book, one is well-prepared to initiate an insider threat program. The book provides examples of insider crimes from nearly every industry segment and ample data to share with management to convince them that the threats, both to their intellectual property and corporate profits, are very real.
After a high-level overview of the topic in chapter 1, the next chapter gets into the details of insider IT sabotage. While some think that stopping IT sabotage is next to impossible, the authors detail and have identified distinct patterns in nearly every IT sabotage case. The book details those patterns and also presents mitigation strategies, both technical and non-technical, to deal with those threats.
The chapter provides fascinating insights into how these crimes are carried out. The authors note that by their very nature, these attacks require technical sophistication and privileged access and are usually carried out by sysadmins, DBA's and programmers. A surprising CERT finding is that the majority of the attacks occur after the insider has been terminated or quit the organization. Part of the problem is that many organizations don't have a process in place to immediate terminate access when a worker resigns or is fired. In addition, 25% of the cases were carried out by full-time contractors.
Chapter 3 provides an intriguing look at the issue of insider theft of intellectual property (IP). Any firm that has a sizable amount invested in their IP (i.e., anything you can put on a USB stick) needs to take this chapter to heart. One of the many misconceptions CERT research has uncovered on this topic is that sysadmins are indeed not the biggest threat to IP, even though they have complete access to networks, systems and data.
According to the CERT data, they have not found a single case in which a sysadmin stole IP. Rather the biggest threat to IP is insider theft by scientists, engineers, programmers or salespeople. Also, CERT found that about a third of the IP cases were carried out for the benefit of a foreign government of organization, with China having more cases of IP theft than the other 9 countries combined.
Given the nature of China and its appetite for data theft, the book is surprisingly silent on specific suggestions in which to deal with threats from China. I would have liked to have seen at least a chapter dedicated to this topic.
The chapter continues and provides detailed lists of issues leading to job dissatisfaction that can lead a trusted employee or contractor to commit IP theft, and provides detailed steps on what companies can do to stop it.
Chapter 4 details everything you need to know about insider fraud. A fascinating statistic detailed is that the average insider fraud crime spans about 15 months, with half of the crimes lasting 5 months or more. The authors write that insider fraud is typically a long and ingoing crime. All of this is happening, over the course of months and years, and the organizations being pilfered are oblivious to it.
The book is worth reading for chapter 6 alone, which details best practices for the prevention and detection of insider threats. The best practices in chapter 6 give the reader a framework for establishing an insider threat program. Many of the best practices detailed are elements of a good security program, so they should not be news to anyone. Some of the best practices include: security awareness training, physical security controls, separation of duties, and perhaps the most blatantly obvious suggestion of them all: deactivate access following termination.
Another fascinating fact detailed in the book is that almost all insiders involved in acts of IT sabotage displayed behavioral indicators prior to committing their crimes. Some of those indicators include: conflicts with coworkers or supervisors, improper use of data assets, sanctions and rule violations. Organizations that act on these precursors can prevent the insider crimes from taking place.
Aside from its lack of coverage on how to specifically deal with the China threat, the only other lacking in the book is that in all of the examples and case studies, even those whose breaches are publically known, organizations are not mentioned by name.
According to author Dawn Cappelli, Technical Manager at the CERT Insider Threat Center, they took that approach based on interviews for approximately 230 of their cases, with prosecutors, investigators, victim organization, or convicted insiders. In those interviews they guaranteed confidentiality of the information they obtained. Therefore, CERT considers the success of their research directly related to their reputation in the community for being trustworthy for maintaining confidentiality. While there reasoning makes sense, anonymous case studies are often unsatisfying
Insider threats are pervasive and undisputable. Organizations such as the CERT Insider Threat Center and individuals like Antonio Rucci provide vital services evangelizing about this critical topic. This entertaining video of Rucci from DEFCON 17 is a great primer on the topic.
Most of the firms who fall victim to insider threats are oblivious to them as they occur. The book details effective and operational security practices which can help every organization create an insider threat program to counterattack the majority of insider attacks.
When it comes to insider threats, the only way to avert them is to have a prevention program in place. In The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, the authors have created an invaluable guidebook, with myriad details in which to enable the reader do that. The facts around insider threats speak for themselves. Anyone charged with protection of corporate data should ensure this book is on their required reading list. If not, and they fall victim to an insider attack, they have no one to blame but themselves.