Abstract-The insider threat is one of the most pernicious in computer security. Traditional approaches typically instrument systems with decoys or intrusion detection mechanisms to detect individuals who abuse their privileges (the quintessential "insider"). Such an attack requires that these agents have access to resources or data in order to corrupt or disclose them. In this work, we examine the application of process modeling and subsequent analyses to the insider problem. With process modeling, we first describe how a process works in formal terms. We then look at the agents who are carrying out particular tasks, perform different analyses to determine how the process can be compromised, and suggest countermeasures that can be incorporated into the process model to improve its resistance to insider attack.

Abstract. The formalization of process definitions has been an invaluable aid in many domains. However, noticeable variations in processes start to emerge as precise details are added to process definitions. While each such variation gives rise to a different process, these processes might more usefully be considered as variants of each other, rather than completely different processes. This paper proposes that it is beneficial to regard such an appropriately close set of process variants as a process family. The paper suggests a characterization of what might comprise a process family and introduces a formal approach to defining families based upon this characterization. To illustrate this approach, we describe a case study that demonstrates the different variations we observed in processes that define how dispute resolution is performed at the U.S. National Mediation Board. We demonstrate how our approach supports the definition of this set of process variants as a process family.

No abstract

No abstract