A Risk Management Approach to the “Insider Threat”

Abstract

Recent surveys indicate that the financial impact and operating losses due to insider intrusions are increasing. But these studies often disagree on what constitutes an "insider;" indeed, many define it only implicitly. In theory, appropriate selection of, and enforcement of, properly specified security policies should prevent legitimate users from abusing their access to computer systems, information, and other resources. However, even if policies could be expressed precisely, the natural mapping between the natural language expression of a security policy, and the expression of that policy in a form that can be implemented on a computer system or network, creates gaps in enforcement. This paper defines "insider" precisely, in terms of these gaps, and explores an access-based model for analyzing threats that include those usually termed "insider threats." This model enables an organization to order its resources based on the business value for that resource and of the information it contains. By identifying those users with access to high-value resources, we obtain an ordered list of users who can cause the greatest amount of damage. Concurrently with this, we examine psychological indicators in order to determine which users are at the greatest risk of acting inappropriately. We conclude by examining how to merge this model with one of forensic logging and auditing.

Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

“…Bishop et al [13], [14] propose a graduated notion of insiderness. They introduce a hierarchy of policy abstractions, and argue that the discrepancies between the different layers of abstraction are useful for identifying insider threats.…”

Assessing Continuous Evaluation Approaches for Insider Threats: How Can the Security Posture of the U.S. Departments and Agencies Be Improved?

“…115-137. 17 Bishop et al, 2010. 18 Imperva, Insiders: The Threat Is Already Within, Hacker Intelligence Initiative Report, Redwood Shores, Calif., 2016.…”

Insider Threat Identification by Process Analysis

“…Park and Giordano [25] reverse the Hu et al approach, analyzing a user's behavior and checking that it is as expected. Several researchers [26]- [28] incorporate risk assessment into an extended access control framework, adapting user privileges based on role, attributes, and level of trust, which drops when a user's behavior becomes suspicions. Other work extends the RBAC model by focusing on generalized attributes of people and data, and placing the insider threat in the context of modeling policies using layers of abstraction [29], [30].…”