KnowledgeDiagrams and notes
Diagrams and notes on program design, evidence, and operations.
Same Taxonomy, Same Meaning?
Alert classification, case closure, and risk acceptance are different decisions. The operating model must assign each one.
Three Non-Interchangeable Approaches to an Insider Program
The same components in all three. What differs is the order they are put in.
Preserving Authorization History
The question is rarely whether someone had the right. It is whether you can still show they had it at the time.
Insider Risk / Threat Convergence
Exposure, observed events, and possible intent provide different kinds of evidence. A case tests how they relate, without requiring the motive to be known in advance.
Four Records and a Fifth That Hold an Insider Program Together
Each either exists or it does not: an initial test of whether the functions have a meeting point, not proof that the program works.