Mitigating Inadvertent Insider Threats with Incentives

Liu, Debin; Camp, L. Jean

doi:10.1007/978-3-642-03549-4_1

Cited by 20 publications

(11 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Insiders' privileged access allows them to easily abuse organizational trust for personal gain [34]. Privileged access makes it simpler for the insider to cause serious harm to the organization than it would be for someone attacking from outside.…”

Section: Access and Level Of Trustmentioning

confidence: 98%

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

Munshi

Dell

Armstrong

2012

2012 45th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Almost all organizations and sectors are currently faced with the problem of insider threats to vital computer assets. Internal incidents can cause more than just financial losses; the costs can also include loss of clients and damage to an organization's reputation.Substantial academic research investigating internal threats has been conducted. This paper examines a number of theoretical models drawn from academic literature to identify a set of factors that are thought to be behavior factors associated with insider threats. These factors are then critiqued using empirical evidence from reported incidents, resulting in insights into areas where the theoretical perspectives of academic literature are both supported and unsupported by actual case evidence. The paper concludes with recommendations for future research directions for academic researchers.

show abstract

Section: Access and Level Of Trustmentioning

confidence: 98%

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

Munshi

Dell

Armstrong

2012

2012 45th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…On the other hand, previous works have designed incentive mechanisms (e.g., [11], [12]) and information mechanisms (e.g., [13]) to enhance insiders' compliance, reduce users' misbehavior, and reduce false positives.…”

Section: A Alert Managementmentioning

confidence: 99%

RADAMS: Resilient and Adaptive Alert and Attention Management Strategy against Informational Denial-of-Service (IDoS) Attacks

Huang,

Zhu

2021

Preprint

View full text Add to dashboard Cite

Attacks exploiting human attentional vulnerability have posed severe threats to cybersecurity. In this work, we identify and formally define a new type of proactive attentional attacks called Informational Denial-of-Service (IDoS) attacks that generate a large volume of feint attacks to overload human operators and hide real attacks among feints. We incorporate human factors (e.g., levels of expertise, stress, and efficiency) and empirical results (e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators' attention dynamics and their decision-making processes along with the real-time alert monitoring and inspection. To assist human operators in timely and accurately dismissing the feints and escalating the real attacks, we develop a Resilient and Adaptive Data-driven alert and Attention Management Strategy (RADAMS) that deemphasizes alerts selectively based on the alerts' observable features. RADAMS uses reinforcement learning to achieve a customized and transferable design for various human operators and evolving IDoS attacks. The integrated modeling and theoretical analysis lead to the Product Principle of Attention (PPoA), fundamental limits, and the tradeoff among crucial human and economic factors. Experimental results corroborate that the proposed strategy outperforms the default strategy and can reduce the IDoS risk by as much as 20%. Besides, the strategy is resilient to large variations of costs, attack frequencies, and human attention capacities. We have recognized interesting phenomena such as attentional risk equivalency, attacker's dilemma, and the half-truth optimal attack strategy.

show abstract

“…So the system is very secure. Wang and Puleo [9,10] worked on the behavioral aspect of insiders. According to the research conducted, it was found that most of the insiders have one or more of the following observable behavior.…”

Section: IImentioning

confidence: 99%

Towards Securing Medical Documents from Insider Attacks

Ahmad¹,

Fahad²,

Khan³

et al. 2016

ijacsa

View full text Add to dashboard Cite

Abstract-Medical organizations have sensitive health related documents. Unauthorized access attempts for these should not only be prevented but also detected in order to ensure correct treatment of the patients and to capture the malicious intent users. Such organizations normally rely on the principle of least privileges together with the deployment of some commercial available software to cope up this issue. But such methods can't be helpful in some of the misuse methods e.g. covert channels. As insiders may be the part of the team which developed such software, he may have deliberately inserted such channels in the source code of that software. The results may be catastrophic not only to that organization but for the patients too. This paper presents an application for securely exchange of documents in medical organizations of our country. The induction of water marking and hash protected documents enhances its security and make it fit to deploy in medical related organizations. The deployment is done in such a way that only higher management has access to the source code for reviewing. Results demonstrate its effectiveness in preventing and detecting majority of the information misuse channels.

show abstract

Mitigating Inadvertent Insider Threats with Incentives

Cited by 20 publications

References 7 publications

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

RADAMS: Resilient and Adaptive Alert and Attention Management Strategy against Informational Denial-of-Service (IDoS) Attacks

Towards Securing Medical Documents from Insider Attacks

Contact Info

Product

Resources

About