Insider Threats in Cyber Security

Preface

Contents

Aspects of Insider Threats

1 Introduction

2 Insiders and Insider Threats

2.1 Insider Threats

2.2 Taxonomies

3 Detection and Mitigation

4 Policies

5 Human Factors and Compliance

6 Conclusion

References

Combatting Insider Threats

1 A Contextual View of Insiders and Insider Threats

2 Risks of Insider Misuse

2.1 Types of Insiders

2.2 Types of Insider Misuse

3 Threats, Vulnerabilities, and Risks

3.1 Relevant Knowledge and Experience

3.2 Exploitations of Vulnerabilities

3.3 Potential Risks Resulting from Exploitations

4 Countermeasures

4.1 Specification of Sound Policies for Data Gathering and Monitoring

4.2 Detection, Analysis, and Identification of Misuse

4.3 Desired Responses to Detected Anomalies and Misuses

5 Decomposition of Insider Misuse Problems

5.1 Stages of Development and Use

5.2 Extended Profiling Including Psychological and Other Factors

6 Requirements for Insider-Threat-Resistant High-Integrity Elections

7 Relevance of the Countermeasures to Elections

8 Research and Development Needs

9 Conclusions

References

Insider Threat and Information Security Management

1 Introduction

2 Definitions of Insider and the Relevance to Information Security Management

3 Risk and Insiderness

3.1 The Importance of Organisational Culture and the Significance of Cultural Risks

3.2 Fieldwork on Culture and the Insider Threat

4 The Structure of the ISMS and Traditional Information Security Management Responses to Insiderness

4.1 Analysis Turning an ISMS Inwards

4.2 The Role of Operationalisation

5 Information Security Management Standards, Best Practice and the Insider Threat

5.1 General Security Management Standards

5.2 Guidelines Focused on the Management of the Insider Threat

5.3 Analysis of the Contribution of Best Practice and Guidelines

6 Crime theories and insider threat

6.1 Existing Connections between Crime Theories and Information Security Management

7 Implications of Crime Theories for ISMS Design

7.1 Application of SCP to the ISO Control Domains

7.2 Implications for ISMS Process Design

7.3 Summary of Crime Theory Contribution

8 Conclusions

References

A State of the Art Survey of Fraud Detection Technology

1 Introduction

1.1 Data Analysis Methodology

1.1.1 General

1.1.2 Procedure

2 Survey of Technology for Fraud Detection in Practice

2.1 General Approaches for Intrusion and Fraud Detection

2.2 State of the Art of Fraud Detection Tools and Techniques

3 Why Fraud Detection is not the Same as Intrusion Detection

4 Challenges for Fraud Detection in Information Systems

5 Summary

Acknowledgements

References

Combining Traditional Cyber Security Audit Data with Psychosocial Data: Towards Predictive Modeling for Insider Threat Mitigatio

1 Introduction

2 Background

3 Issues of Security and Privacy

4 Predictive Modeling Approach

5 Training Needs

6 Conclusions and Research Challenges

7 Acknowledgments

References

A Risk Management Approach to the “Insider Threat”

1 Introduction

2 Insider Threat Assessment

2.1 Example

2.2 Summary

3 Access-Based Assessment

4 Psychological Indicator-Based Assessment

5 Application of Risk to System Countermeasures

5.1 Example

5.2 Summary

6 Conclusion

References

Legally Sustainable Solutions for Privacy Issues in Collaborative Fraud Detection

1 Introduction

2 Monitoring Modern Distributed Systems

2.1 Evidence Model

3 Observing Fraudulent Service Behaviours

3.1 Architectural Support

4 Introduction to the Legal Perspective

5 Basic Principles of Data Privacy Law

5.1 A Set of Six Basic Rules

5.1.1 Data Avoidance

5.1.2 Transparency

5.1.3 Purpose Specification and Binding

5.1.4 ProhibitionWithout Explicit Permission

5.1.5 Data Quality

5.1.6 Data Security

6 General Legal Requirements of Fraud Detection Systems

6.1 Privacy Relevance of Fraud Detection Systems

6.2 Necessary Data for Fraud Detection

6.3 Transparency in the Fraud Detection Context

6.4 Purpose Specification and Binding in Fraud Detection

6.5 Permissibility of Fraud Detection

6.6 Quality of Event Data

6.7 Security of Event Data

7 Technical Solutions for Privacy-respecting Fraud Detection

7.1 Technical Requirements

7.1.1 Requirements for Open Data

7.1.2 Specific Requirements for Pseudonyms in Open Data

7.1.3 Specific Requirements for Covered Data

7.2 Lossless Information Reduction with Covered Data

7.3 Lossy Information Reductions for Timestamps

7.3.1 Architecture and Algorithm

7.3.2 Limitations

7.3.3 Evaluation

8 Legal Improvements by Pseudonymizing Event Data

8.1 Technical Description

8.2 Privacy Relevance of Pseudonymized Event Data

8.3 Strengthening the Data Privacy Official

8.4 Disclosure With Legal Permission

8.5 Data and System Security

9 Conclusion

Acknowledgements

References

Towards an Access-Control Framework for Countering Insider Threats

1 Introduction

2 Motivation and related work

2.1 Illustrative scenarios

2.2 Definitions of insiders

2.3 Access control

2.4 The insider problem and access control

3 Trust, trustworthiness, and the insider problem

3.1 Insiderness

3.2 Trust management and risk assessment

3.3 Pragmatics of identifying suspicious events

4 Toward a contextand insider-aware policy language

4.1 Context and request predicates

4.2 Requirements

4.3 Policy transformations via declarative programming

4.4 Discussion of requirements

4.5 Policy transformations

4.6 Riskand trustworthiness-aware policy composition

5 Access-control architectures and the insider problem

6 Concluding remarks

References

Monitoring Technologies for Mitigating Insider Threats

1 Introduction

2 Related Research

3 Threat Model Level of Sophistication of the Attacker

4 Decoy Properties

5 Architecture

5.1 Decoy Document Distributor

5.2 SONAR

5.3 Decoys and Network Monitoring

5.4 Host-based Sensors

6 Concluding Remarks and Future Work

Acknowledgments

References

Insider Threat Specification as a Threat Mitigation Technique

1 Introduction

1.1 The Insider Threat Problem

2 Background

2.1 The Common Intrusion Specification Language

2.2 Panoptis

3 Insider Misuse Taxonomies and Threat Models

4 The Scope of the Insider Threat Prediction Specification Language

4.1 The Domain Specific Language Programming Paradigm

5 Conclusion

References