cb-subtype-vocab

Theft Of Physical Company Property (1.1)

Stealing their employer’s physical property (e.g., the insider reported a company laptop as stolen, but had it when they were arrested)

Insider Expressed Ownership Of Work (1.2)

Acting as if they had personal right to any work done for the organization, despite knowledge of organizational right to employee work (e.g., the insider refused to return copy of code that they wrote because they felt entitled to it)

Repeated Security Violations - Non-Technical (1.3)

Violating organizational security policies not related to IT systems (e.g., the insider broke into the school on multiple occasions and was also caught cheating)

Other Unauthorized Software Acquisition (2.1)

Acquiring any sort of unauthorized software on an organizational system (e.g., the insider downloaded a password recovery tool from a website)

Repeated Security Violations - Technical (2.2)

Multiple instances of security violations related to organizational IT systems (e.g., the insider repeatedly let co-workers use their workstation)

Unauthorized Download - Remotely (2.3)

Unapproved download from offsite (e.g., the insider logged into their company account from home on their personal laptop and downloaded torrents)

Unauthorized Download - On Site (2.4)

Unapproved download from within the organization (e.g., the insider used their company-issued workstation to download torrents)

IP Policy Violation (2.5)

Violating any of the policies put in place by the company regarding their IP (i.e. trade secrets, patents, copyright, etc.)

Violation of Need to Know (2.6)

Accessing organizational information which is not needed for their work, as defined by organizational policy

Employee Extortion, Threats, or Legal Demands (3.1)

Extortion, threats (physical, technical, legal, etc.) or legal demands against the organization (e.g., the insider threatened to sue company unless they agreed to the terms of their demands)

Conflict With Supervisor (3.2)

Personal or work-related disputes with their supervisor (e.g., the insider was unhappy with their new boss because the boss modified the organization’s bonus system)

Conflict With Coworker(s) (3.3)

Personal or work-related disputes with a coworker (e.g., the insider yelled at a coworker for repeatedly parking in their spot)

Work Attendance Problems (3.4)

Being late for work or having unexcused/unplanned absences from work, generally multiple times (e.g., the insider reports late to work 7 times during the month of April)

Human Resource Policy Violations or Complaints (3.5)

Violating the organization’s human resource policy or making a formal complaint about something/someone within the organization (e.g., the insider made several complaints to management about their co-worker’s noise level)

Disgruntled Employee (3.6)

One who is upset with the organization and desires to get a measure of revenge against the organization (e.g., the insider grew disgruntled because of losing their ‘star’ status at the organization as it grew larger)

Bragging (3.7)

The insider boasts about a concerning behavior to co-workers or online (e.g., the insider boasted about being able to shut down the organization’s system anytime they wanted)

Concurrent Crimes (3.8)

The insider commits a second illegal action while committing the unrelated illegal insider incident (e.g., the insider was indicted for domestic abuse while committing the insider incident)

Formal Complaint (3.9)

Organization receives complaints about the insider from a coworker which were officially documented

Informal Complaint (3.10)

Organization receives complaints about the insider from a coworker which were not officially documented

Insubordination (3.11)

Defiance or refusal to follow commands or instructions

Physical Abuse/Harassment (3.12)

Engaging in any type of physical abuse and/or harassment against another employee

Sexual Harassment (3.13)

Engaging in any type of sexual harassment against another employee

Unexplained Wealth (4.1)

A sudden increase in the amount of money the insider appears to have (e.g., the insider purchased $400,000 in personal items even though their annual salary was $50,000)

Employee Forms New Competing Business (4.2)

Maintains a financial stake in another business or scheme that conflicts with their present employer (e.g., the insider invests in stocks of the victim organization’s competitor)

Financial Conflict of Interest (4.3)

Starting a business in the same area as their previous employer (e.g., the insider left one law firm to start their own law firm)

Planning/Contact with Competing Organization (5.1)

Conspiring with a competitor of the current employer in any way (e.g., the insider e-mailed a competing organization detailing plans to steal trade secrets)

Employee Went To Work For A Competing Organization (5.2)

Leaving their current employer and joining a competing organization. E.g., Insider accepted a position at a competing technical firm before resigning from their current position.

Employee Sought Other Employment (5.3)

Seeking another job while still employed with their current employer (e.g., the insider sent their resume to another organization)

Group Resignation (5.4)

Two or more employees leave the organization at approximately the same time for similar reasons (e.g., all five insiders resigned simultaneously, then went to work for a competitor)

Insider Creates Legal Entity for Illegitimate Purpose (5.5)

Creates a legal entity in order to move forward with scheme or to hide assets as a result of the scheme (e.g., the insider creates a shell company to protect assets)

Falsified Background Information (5.6)

Lies about or otherwise manipulates information about their background: personal or financial history, contacts, groups, etc.

Suspicious Foreign Contact (6.1)

Tie(s) to foreign nation(s) such as company or independent travel, family members, telephone records, etc. (e.g., the insider consistently calls former co-worker who now works in a non-allied country)

Suspicious Foreign Travel (6.2)

Traveling to foreign nations that, if the travel was known, should raise concerns with the organization

Foreign Travel - Work Related (6.3)

Travel undertaken by the insider as required for their job (e.g., the insider’s job required frequent travel to non-allied countries)

Planning/Contact with Conspirator (6.4)

Conspiring with a conspirator in order to begin or further their particular scheme (e.g., the insider calls their partner-in-crime in order to establish attack details)

Geographic Relocation (7.1)

Permanent move to a new physical location