Building a multidimensional pattern language for insider threats

As part of ongoing insider threat research at the CERT Program, we have developed 26 patterns for insider threat. This paper describes our attempts at organizing those patterns into a pattern language. After discarding several hierarchical, unidimensional models, we adopted a multidimensional organization that allows searching and browsing along five dimensions simultaneously, using faceted classification. We illustrate the resulting pattern language with a sample pattern, including a discussion of our use of Business Process Modeling Notation (BPMN) and brief descriptions of all the patterns.