Mitigating Insider Threats: Insights from Software Security Experts for Process Improvement and Risk Reduction

Context: Developing secure environments to mitigate insider threats is gaining popularity across various industrial domains. Organizations are unprepared and unfamiliar with this new genre of insider threats because research on the fundamental security practices required for developing secure environments is lacking.Objective: This study examines how software security experts perceive the effectiveness of best practices for improving the mitigating process of insider threats.Method: A systematic literature review (SLR) and a survey of 76 security practitioners from 74 countries, spanning 13 primary business functions of organizations and four distinct types of industries, were conducted to rate the effectiveness of the practices in mitigating insider threats.Results: Four key knowledge areas of secure environments against insider threats (compliance, top management, human resources (HR), and information technology (IT)) and the associated best practices for each knowledge area were identified. The survey results provide insight into the importance of each practice within the knowledge areas. The findings suggest potential implications of the best practices for improving the mitigating process of insider threats in future software projects.Conclusion: This study provides critical and timely insights into fundamental practices in order to improve the mitigation process of insider threats and educates software engineering professionals and researchers on the challenges and solutions for insider threats.