Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders

Abstract

vii AbstractUniversal serial bus (USB) storage devices are useful for transferring information within an organization; however, they are a common threat vector through which data exfiltration can occur. Despite the threat, many organizations feel that the utility of USB storage devices outweighs the potential risks. Implementing controls to track the use of these devices is necessary if organizations wish to retain sufficient situational awareness and auditing capabilities to detect data theft incidents.This report presents methods to audit USB device use within a Microsoft Windows environment. Using various tools-the Windows Task Scheduler, batch scripts, Trend Micro's OSSEC hostbased intrusion-detection system (HIDS), and the Splunk log analysis engine-we explore means by which information technology (IT) professionals can centrally log and monitor USB device use on Microsoft Windows hosts within an organization. In addition, we discuss how the central collection of audit logs can aid in determining whether sensitive data may have been copied from a system by a malicious insider.

Insider Threat Risk Prediction based on Bayesian Network

“…Virtual Private Network (VPN) data flow monitoring (Cappelli et al, 2012), Web traffic inspection (George J. Silowash, Todd Lewellen, 2013), and Correlating Events from Multiple Sources such as Universal Serial Bus (USB) (Silowash and Lewellen, 2013), are different types of DLP security controls. All of these controls can be used to mitigate insider threats by analysing information about changes in the behaviour or activities of authorised users.…”

“…In the proposed framework, opportunities were measured by contract expiration dates, authorised user system role, as well as the employee's relationship to the organisation they work for (for example, a current employee, former employee, contractor, etc.) (Centre for the Protection of National Infrastructure, 2013; Moore et al, 2011;Silowash and Lewellen, 2013;Ghaffarzadegan, 2008).…”

Insider Threat Detection Using Multi-autoencoder Filtering and Unsupervised Learning

“…The Software Engineering Institute at Carnegie Mellon University has done considerable work on detecting insider threats. For example, researchers have inspected network traffic through the Squid proxy server [25], set up access control lists and signatures, and tagged documents to check if data leakage has occurred from within an organization. Splunk [27] has created mature security products for log management and anomaly detection.…”