  Compliance management plays an important role in mitigating insider threats.
Incentive design is a proactive and non-invasive approach to achieving
compliance by aligning an insider's incentive with the defender's security
objective, which motivates (rather than commands) an insider to act in the
organization's interests. Controlling insiders' incentives for population-level
compliance is challenging because they are neither precisely known nor directly
controllable. To this end, we develop ZETAR, a zero-trust audit and
recommendation framework, to provide a quantitative approach to model insiders'
incentives and design customized recommendation policies to improve their
compliance. We formulate primal and dual convex programs to compute the optimal
bespoke recommendation policies. We create the theoretical underpinning for
understanding trust, compliance, and satisfaction, which leads to scoring
mechanisms of how compliant and persuadable an insider is. After classifying
insiders as malicious, self-interested, or amenable based on their incentive
misalignment levels with the defender, we establish bespoke information
disclosure principles for these insiders of different incentive categories. We
identify the policy separability principle and the set convexity, which enable
finite-step algorithms to efficiently learn the Completely Trustworthy (CT)
policy set when insiders' incentives are unknown. Finally, we present a case
study to corroborate the design. Our results show that ZETAR can well adapt to
insiders with different risk and compliance attitudes and significantly improve
compliance. Moreover, trustworthy recommendations can provably promote cyber
hygiene and insiders' satisfaction.
