Search

An insider is a person or software that possesses positive authorization to access the asset(s) of an enterprise. In recent years, security incidents perpetrated by enterprise insiders have increased considerably. Enterprises attempt to mitigate such threats by implementing controls intuitively, on an ad-hoc basis. However, such intuitive control implementation is both time-consuming, as well as prone to errors, leading to insecure enterprise systems. The paper attempts to address this issue by proposing a structured methodology for the selection of relevant security controls. The technique is to model insider threats and security controls, and match their constituent components against each other. The proposed methodology has been illustrated with suitable examples.

Insider threats within organizations can take a variety of forms including fraud, theft of classified or proprietary data, and workplace violence. Insiders can be overt individuals who commit deliberate acts against their organization, or inadvertent insiders who provide access to organizational IT systems. The damage from insider threats was estimated at an annualized average of $4.3M per company across a variety of industries in a 2016 study, which does not include the damage to an organization’s reputation, loss of business, and decrease in company value. The Scientific advances to Continuous Insider Threat Evaluation (SCITE) program sponsored by the Intelligence Advanced Research Projects Activity (IARPA) was created to improve insider threat detection. In the first phase of this effort, three competing teams were provided aggregated individual performance data and asked to answer system performance questions on a range of complex challenge problems. The purpose was to be able to detect a subset of individuals from within the overall population of an organization that displayed a behavior or belonged to a group. Teams were scored on three metrics: mean squared error, calibrated certainty interval, and interval score. The team led by Innovative Decisions, Inc. (IDI) used a multiple model approach with data fusion to model these problems. This approach proved far superior to the methods used by the two other teams across all three metrics. The results of this research are applicable to any area where the objective is to identify a very small subset of a much larger group using incomplete, noisy data. Specific areas benefitting education and research include airline passenger screening, vetting of immigration or visa applications, and security clearance reviews.

We describe the development and envisioned use case applications of a comprehensive insider threat ontology—“Sociotechnical and Organizational Factors for Insider Threat” (SOFIT)—that comprises more than 300 indicators of technical, behavioral, and organizational factors. Requirements, design, and engineering development for the Web Ontology Language (OWL) implementation of the SOFIT knowledge base are reviewed; additional relationships among constructs are defined that extend the representation beyond a simple taxonomic hierarchy and that enable inferences for qualitative and quantitative threat assessment. We show how queries may be constructed to support these inferences and threat assessments. Several major application concepts are reviewed to show how the ontology may be used by the insider threat research and operational communities. To this end, the SOFIT knowledge base may be shared with stakeholders to advance research and practice for proactive insider threat mitigation.

The most dangerous threats faced by organizations are insider attacks. Since insiders are aware of the underlying system, handling insider attack is a most deterring task. The volume of attacks posed by insiders on cloud is very much higher than the traditional systems, as the attack vector and scope of the attack is high in cloud1. Insider attack affects the reputation and productivity of the organization and drags it into losses. Insiders may cause damage accidentally or intentionally. Proper management of privileges reduces the threats posed by insiders. So by properly managing privileges, insider threats can be reduced. This paper proposes a privilege management mechanism which manages the users by incorporating risk, trust into an access control mechanism to develop more scalable and flexible prevention mechanism against insider attacks.

Insider threat is one of the most dangerous security threat, and a much more complex issue. These insiders can be a former or a disgruntled employee or any business associate that has or had an authorised access to information for any particular organization. They have control and security measures. Hence continuous monitoring is essential to track each and every activity within the network. Log management is a strong technique which includes both Log analysis with event correlation which provides the root cause of any attack and network can be protected from security violations. Though intrusion detection is complex process, while checking the ability to detect intrusive behaviour within the internal environment, it has to take care of suppressing the false alarm rate. Some strong approach is required on the basis of which decisions can be taken fast. This paper proposes a probabilistic approach which illustrates the frequency of occurrence of event in percentage while still considering the false alarm rate at an acceptable level.

Insider threat becomes a more and more serious problem to organizations. Identify theft is a common attack method among various attack methods from insider. And it is very hard to detection since the attacker acts as a legal identity. Existing researches focus on Human Computer Interaction (HCI) behavior such as keystroke dynamics or mouse dynamics to detection this kind of attack. Based on an obvious observable that different applications show different HCI behavioral patterns (rich-key-operations or rich-mice-operations), we demonstrate that single authentication method is not efficient always in full time work period. In this paper, we provide an ensemble re-authentication approach to detection identify theft in real time, which combine the classification of keystroke-classifier and mice-classifier to determine whether the current operations is produced by the real legitimate user or not. Our experiment proves this new approach is efficient and can provide consistent detection ability with high accuracy.