A Method of Evaluation for Insider Threat

Wang, Yi Lu; Yang, Sang Chin

doi:10.1109/is3c.2014.121

Cited by 5 publications

(2 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Barriers, firewalls and other controls intended to stop external adversaries are generally ineffective for insiders, making this a major and complex security challenge [1]. Although attacks from outside the organisation are more frequent, insiders deliberately or inadvertently misusing their knowledge and access to information generate greater overall consequences [2][3][4][5]. Estimates of the costs of the average insider incident exceed US$400,000, and many incidents exceed US$1 billion in losses [6].…”

Section: Introductionmentioning

confidence: 99%

A Risk-Based Framework to Inform Prioritisation of Security Investment for Insider Threats

Sektas-Bilusich¹,

Nunes-Vaz²,

Chim³

et al. 2020

IJSSE

View full text Add to dashboard Cite

Threats to information security from inside an organisation are difficult to manage as insiders, by definition, have legitimate access to the organisation's information, consistent with their roles. Impacts of insider threats range from minor information compromise perhaps through carelessness, to catastrophic financial and reputational damage. Security managers are required to continually upgrade security measures to reduce the risk posed by insider threats, however with so many security controls to choose from, finding optimal security solutions based on benefit-cost is challenging. We have developed a risk-based framework called Security-in-Depth (SiD) where residual risk is the metric that assists the security manager to make informed decisions on which security packages contribute more to the organisation's security objectives. We present a case study to illustrate the way our framework is applied, customised to manage a range of insider threats. Uncertainties about the future threat spectrum and the future effectiveness of controls are included in the framework to inform the decisionmaking process.

show abstract

Section: Introductionmentioning

confidence: 99%

A Risk-Based Framework to Inform Prioritisation of Security Investment for Insider Threats

Sektas-Bilusich¹,

Nunes-Vaz²,

Chim³

et al. 2020

IJSSE

View full text Add to dashboard Cite

show abstract

“…By virtue of their privileged status, trusted insiders are able to exploit vulnerabilities created by their legitimate access to sensitive information, as well as those created by failures of effective internal security implementation. While the incidence of insider misuse may be lower than that of attacks from outside the organisation, their consequences are generally more serious [2]- [5]. It has been estimated that on average each insider incident costs in excess of $400,000; and there have been multiple incidents with losses exceeding $1 billion [6].…”

Section: Introductionmentioning

confidence: 99%

There Is No Single Solution to the ‘Insider’ Problem but There Is a Valuable Way Forward

et al. 2018

View full text Add to dashboard Cite

The threat posed by insiders deliberately or inadvertently misusing their knowledge and access to sensitive information is a major security challenge. Finding effective, acceptable and affordable ways to manage the insider threat is non-trivial, involving the use of controls that range from technical to procedural. To make matters worse, insider activities range from inadvertent or accidental disclosure, through deliberate damage caused by disgruntled employees, to the pre-positioned mole who may undermine the organisation's viability or purpose. The same controls will have different levels of effectiveness for each of these insider types. Based on these factors, attempting to find a single, optimised, universal solution to insider threats is illogical. However, the literature still contains statements such as 'deterrence is the best approach for insiders'. There are dangers for security managers in drawing broad conclusions across the insider threat spectrum based on statements like these. Insider threats typically have a distribution of incidents where there are many of small consequence coexisting with a small number of incidents with very large consequences. This suggests that risk management techniques are a relevant, and arguably the most appropriate, framework for insider management. We have developed and applied a risk-based framework to model the spectrum of insider threat types, to enable the decision maker to determine the relative security effectiveness of alternative solutions. It allows decision makers to prioritise security investment to achieve the greatest benefit-cost using residual risk as the performance metric. Our framework provides a traceable and accountable method for organisations to balance their investments in controls, according to the complex spectrum of insider activity they are dealing with. They may also extend the approach, using robust analysis, to manage their uncertainties. Our framework supports security managers in customising security for their organisation based on its unique requirements.

show abstract

A literature survey of security issues in Cloud, Fog, and Edge IT infrastructure

Beebe

Choo

2022

Electron Commer Res

View full text Add to dashboard Cite

A Method of Evaluation for Insider Threat

Cited by 5 publications

References 7 publications

A Risk-Based Framework to Inform Prioritisation of Security Investment for Insider Threats

A Risk-Based Framework to Inform Prioritisation of Security Investment for Insider Threats

There Is No Single Solution to the ‘Insider’ Problem but There Is a Valuable Way Forward

A literature survey of security issues in Cloud, Fog, and Edge IT infrastructure

Contact Info

Product

Resources

About