IT Security Trust Model - Securing the Human Perimeter

Abstract

Abstract-There are numerous technical advances in the field of Information Security (IS). Despite the application of these IS technological controls, it is often not enough to address security issues due to the vulnerable human component. With a considerable amount of support in literature, there is no doubt that the human factor is a major weakness in preventing IS breaches. The true level of security in technology and process relies on the people involved in its use and implementation. Thus, human factors play an increasing role in securing computer information assets and therefore are detrimental to the security of an organization. One of the most prominent aspects of security, which is linked to humans, is trust. It is safe to presume that trust will play an important role in any IS environment and may influence security behavior significantly. In this paper the findings of a prior study, which focused on identifying human security elements, their relationship with, and consequently their influence on trust, are explored further. This paper builds upon the prior study of identified human security elements, which spawns IS trust factor elements of a previously proposed IT Security Trust (ITST) Model. Furthermore, the paper adapts and expands the original ITST Model, renamed to Information Security DNA Model, providing insight into and recommendations on how the trust factor elements may be utilized in an attempt to manipulate human behavior in such a manner to equip employees with the necessary behavioral attributes for combatting social engineering related attacks within organizations which choose to follow an IS model built on the foundation of trust.Index Terms-Information security, social engineering, human factor, trust factors, trust, smart trust, information security DNA model, IT security trust model.

A Taxonomy for Threat Actors’ Delivery Techniques

“…Finally, from the perspective of the delivery path, we identify two main views for an organization security perimeter: the logical and the physical view. The human fact is a key piece in security that has been largely analyzed [59][60][61], and some even works [62][63][64] define a human perimeter for organizations. However, we will focus on the logical and physical perimeters: although many delivery techniques, such as spear phishing, rely on human vulnerabilities, the delivery itself has to be performed, breaking a logical or a physical protection.…”

Modeling of Advanced Threat Actors: Characterization, Categorization and Detection

“…Finally, from the perspective of the delivery path, we identify two main views for an organization security perimeter: the logical and the physical view. The human fact is a key piece in security that has been largely analyzed [36,147,240], and some even works [44,600,639] define a human perimeter for organizations. However, we will focus on the logical and physical perimeters: although many delivery techniques, such as spear phishing, rely on human vulnerabilities, the delivery itself has to be performed, breaking a logical or a physical protection.…”