Insider Threat Identification by Process Analysis

Abstract

Abstract-The insider threat is one of the most pernicious in computer security. Traditional approaches typically instrument systems with decoys or intrusion detection mechanisms to detect individuals who abuse their privileges (the quintessential "insider"). Such an attack requires that these agents have access to resources or data in order to corrupt or disclose them. In this work, we examine the application of process modeling and subsequent analyses to the insider problem. With process modeling, we first describe how a process works in formal terms. We then look at the agents who are carrying out particular tasks, perform different analyses to determine how the process can be compromised, and suggest countermeasures that can be incorporated into the process model to improve its resistance to insider attack.

Isabelle Modelchecking for Insider Threats

“…On the formal side within the Insider threat community in general, the work by Bishop et al [3] is relevant to the Isabelle Insider framework since it also uses a formal model to analyse Insider threats. Bishop and colleagues use the LITTLE-JIL process description language, a general framework for Software Engineering.…”

Identifying Security Risk Modules in Information Systems

“…Indeed, Boss et al (2009) find that the real cause to most security breaches is the human interaction with the systems. Similarly, Posey et al (2011) and Bishop et al (2014) stress that insider threats by employees or users are the main source for breaches. Thus, the probability of a breach can be approximated by the number of users of the system itself and the systems connected to it.…”

“…Following research that stresses that insider human factor is the greatest cause to security breaches (e.g., Boss et al, 2009;Posey et al, 2011;Bishop et al, 2014) we let the subsystem's exposure to risk to depend on the number of people who have access to it. This information is given in items 11 and 12 of the questionnaire.…”

A fuzzy multicriteria aggregation method for data analytics: Application to insider threat monitoring

“…The insider threat problem is one of the most daunting challenges to handle in computer security, indeed in all aspects of real-world security [1]. The term insider refers to "a current or former employee, contractor or business partner who has authorised access to an organisation's network, system or data, and intentionally exceeds or misuses that access in an manner that adversely affects the confidentiality, integrity or availability of the organisation's information system" [2].…”

“…, c z } of criteria. The Sugeno integral S µ : [0,1] z → [0, 1], associated to a fuzzy measure µ, is defined as follows:…”