A two-dimensional circumplex approach to the development of a hacker taxonomy

Rogers, Marcus

doi:10.1016/j.diin.2006.03.001

Cited by 63 publications

(71 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…As motivações que levam pessoas a cometer crimes cibernéticos podem agrupar-se em categorias conforme suas características (Rogers, 2006). Estas categorias compreendem habilidades e motivações de acordo com o Quadro 1.…”

Section: Motivações Para O Crime Cibernéticounclassified

A influência do contexto organizacional na motivação para a prática de crimes cibernéticos

Garcia

Macadar

Luciano

2018

JISTEM

View full text Add to dashboard Cite

RESUMOEsta pesquisa analisou como a percepção de injustiça organizacional motiva a prática de crimes cibernéticos no local de trabalho. Em uma investigação qualitativa e exploratória, foram realizadas entrevistas com 16 especialistas em segurança cibernética. Os dados foram analisados através da técnica de análise de conteúdo categorial. Os resultados sugerem que a percepção de injustiça produz sentimentos negativos como a baixa-estima, a frustração e a ausência de culpa, e que essas emoções motivam a prática de crimes cibernéticos. Diferentes percepções identificadas entre os entrevistados deste estudo, associadas à revisão da literatura referente ao tema, permitiram a proposição de um modelo conceitual. ABSTRACTThis research analyzes how the perception of organizational injustice motivates the practice of cybercrimes in the workplace. In a qualitative and exploratory investigation, interviews have been carried out for 16 specialists in cybernetic security. Data were analyzed through the categorical content analysis technique. The results obtained suggest that the perception of injustice produces negative feelings, such as low self-esteem, frustration, and lack of guilt, and these emotions, in turn, motivate the practice of cybercrimes. Different perceptions have been identified among the interviewees of this study, which are associated with the literature review related to the theme, allowed the proposition of a conceptual model.

show abstract

Section: Motivações Para O Crime Cibernéticounclassified

A influência do contexto organizacional na motivação para a prática de crimes cibernéticos

Garcia

Macadar

Luciano

2018

JISTEM

View full text Add to dashboard Cite

show abstract

“…Cependant, son manque d'homogénéité la rend très difficile à caractériser. Dans (CERIAS, 2005;Rogers, 2006), les auteurs proposent une classification à deux dimensions considérant les motivations et les compétences des attaquants. Dans (Alata et al, 2006), les auteurs étudient deux catégories d'attaquants : les script kiddies et les black hats.…”

Section: Le Comportement Des Attaquantsunclassified

évaluation quantitative de la sécurité. Approche basée sur les vulnérabilités

Marconato¹,

Nicomette²,

Kaâniche³

2013

Techniques et sciences informatiques

View full text Add to dashboard Cite

RÉSUMÉ. Les travaux présentés dans cet article sont consacrés à la sécurisation des systèmes d'information en se basant sur des mesures quantitatives. Les mesures ont pour but d'aider à la prévision des risques et de fournir les informations nécessaires permettant d'assurer le niveau de sécurité du système en opération. Dans cette approche, nous prenons en considération des facteurs externes ayant un impact significatif sur la sécurité du système. Nous avons identifié trois facteurs, liés au processus d'exploitation d'une vulnérabilité : le cycle de vie de la vulnérabilité, le comportement des attaquants et le comportement de l'administrateur du système. Nous avons étudié les dépendances entre ces différents facteurs et comment leur évolution pouvait impacter la sécurité du système. A partir de cette étude, nous avons défini des mesures quantitatives prenant en compte ces facteurs externes et avons modélisé, en utilisant le formalisme des SAN (Stochastic Activity Networks), le processus d'exploitation de la vulnérabilité qui conduit à la compromission du système. Nous avons distingué deux scénarios selon que la vulnérabilité est découverte par une personne malveillante ou non malveillante. En analysant une base de données de vulnérabilités, nous avons caractérisé la probabilité d'occurrence de plusieurs événements du cycle de vie de la vulnérabilité, que nous utilisons pour l'obtention de nos mesures.ABSTRACT. The objective of this work is the evaluation of information systems security using quantitative measures. These measures aim at forecasting risks and providing information to monitor the security level of the system in operation. In our approach, we take into account some environmental factors that have a significant impact on the security of the system. We have identified three such factors that are related to the vulnerability exploitation process: the vulnerability life cycle, the behavior of the attackers and the behavior of the system administrator. We have studied the dependencies between these factors and how the evolution of these factors could impact the system security. From this study, we have defined quantitative security measures taking into account these environmental factors and we have developed a model 1 re soumission à Technique et science informatiques, le 22/03/2011 2 1 re soumission à Technique et science informatiques based on Stochastic Activity Networks (SANs), describing how the vulnerability exploitation process could lead to system compromission. We have distinguished two scenarios according to whether the vulnerability is discovered by a malicious user or not. By analysing a vulnerability database, we have characterised the probability of occurrence of several events of the vulnerability life cycle. This characterization helped us to quantify the measures by processing the SAN model.

show abstract

“…There is plenty of IT security literature available that sheds light on this aspect and provides a comprehensive classification of attackers [29], [30], [31]. The classification of attackers within the security literature consists of a rather stereotypical technical skill description, and differ only in that an attacker with similar skills is described using different names in different sources, e.g., an attacker who has the very basic skills is referred to as a script kiddie, novice, newbie, etc., depending on the source.…”

Section: Methodsmentioning

confidence: 99%

Framing the Attacker in Organized Cybercrime

Tariq

Brynielsson

Artman

2012

2012 European Intelligence and Security Informatics Conference

View full text Add to dashboard Cite

Abstract-When large values are at stake, the attacker and the attacker's motives cannot be easily modeled, since both the organization at stake and the possible attackers are unique and have complex motives. Hence, rather than using stereotypical attacker models, recent work proposes realistic profiling of the opponent by the use of user-centered design principles in form of the persona methodology.Today, cybercrime is often organized, i.e., attacks are planned and executed by an organization that has put together a tailormade team consisting of the necessary skills for the task. The actual individuals taking part in the attack might not be aware of or interested in the overall organizational motives. Rather, taking motives behind espionage, fraud, etc., into account requires consideration of the attacking organization rather than the individuals. In this paper, based on interviews with IT security experts, we build on the attacker persona methodology and extend it with methodology to also handle organizational motives in order to tackle organized cybercrime. The resulting framework presented in the paper extends the attacker persona methodology by also using narratives in order to assess the own organization's security. These narratives give rise to intrigue sketches involving any number of attacker personas which, hence, make it possible to take organized cybercrime into account.

show abstract

A two-dimensional circumplex approach to the development of a hacker taxonomy

Cited by 63 publications

References 2 publications

A influência do contexto organizacional na motivação para a prática de crimes cibernéticos

A influência do contexto organizacional na motivação para a prática de crimes cibernéticos

évaluation quantitative de la sécurité. Approche basée sur les vulnérabilités

Framing the Attacker in Organized Cybercrime

Contact Info

Product

Resources

About