Toward a Generic Model of Security in an Organizational Context:  Exploring Insider Threats to Information Infrastructure

In previous simulation studies, attackers were assumed to respond to changes in reward with an S shaped curve and to changes in security with a declining S shaped curve. This paper reports experimental work that investigates the validity of those assumptions. In general, the results suggest that the assumptions are reasonable. BackgroundMuch of the research in computer security focuses on the technological systems interactions. Walters, Liang, Shi, and Chaudhary [1] focus on the technological portion of wireless networking. Early research surveyed by Browne [2] found that that there were thousands of papers on computer security and risk management, but most were too narrow in scope and too fixated on technological fixes to be of much value.Udo's survey [3] of privacy and security concerns as related to e-commerce focuses on how users perceive threats, and concludes that while many IT users feel that security is a critical issue, they don't believe that the government or any technological fix is capable of securing their privacy. In those areas where the human interaction factor is described, the literature tends to focus on the technology side of the interaction rather than the human side. In their book, Cranor and Garfinkel [4] make the point that overly complex passwords can hurt the overall effectiveness of password security. Besar and Arief [5] and Duggan, Johnson and Grawemeyer [6] discuss the impairment of security by legitimate users, their description of the faults focuses on the technical.Sasse et.al.[7] made the point that the human portion of the security problem is the area of highest leverage. Adams and Sasse [8] stated that rather than avoiding investigating the human factors, we need to embrace them. Mitnick and Simon [9] note that the importance of human factor is critical because it is the basis of many threats. Saltzer and Schroeder [10] who recognize that humans play a role, focus mainly on the technological issues of security rather than the interactions of the system with its users and attackers.The human factor is important because engineers cannot evaluate a security system until they can measure the effectiveness and hence the benefit provided by computer security.Carayon [11] describes a "sociotechnical system" which is the amalgamation of humans and their information system.Many firms engage in cost/benefit analysis of security measures before applying them [12][13] [14]. These analyses are primarily qualitative in nature since there are not many quantitative models of the interaction between attacker and security professional. Gordon and Loeb [15] describe how an information system manager might respond in terms of monetary resources for a selected vulnerability, but they do not discuss how this response will affect the likelihood of future attacks. Authors such as Schneier [16] and Cavusoglu, Cavusoglu, and Raghunathan [17] look at the economics of computer security from the user's point of view but cast little light on how attackers respond. Their work assumes that attackers are u...

show abstract

“…al. [39] uses a similar approach to examine insider threats to an organizational information system. Rosenfeld et.…”

Section: Simulation Studies For Information Securitymentioning

confidence: 99%

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

Rounds

Pendegraft

Alves-Foss

2013

2013 46th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…Damage from internal sources is one of the most serious problems organizations face, and it is difficult to overcome [6]. This threat is associated with authorized users who abuse their privileges in ways that can cause major damage or loss to a company [38]. All employees can cause possible internal damage in some form; however, trusted employees have the most potential to harm the organization, through damage to the accumulated information or by destabilizing the operation system [27].…”

Section: Introductionmentioning

confidence: 99%

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

Munshi

Dell

Armstrong

2012

2012 45th Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Almost all organizations and sectors are currently faced with the problem of insider threats to vital computer assets. Internal incidents can cause more than just financial losses; the costs can also include loss of clients and damage to an organization's reputation.Substantial academic research investigating internal threats has been conducted. This paper examines a number of theoretical models drawn from academic literature to identify a set of factors that are thought to be behavior factors associated with insider threats. These factors are then critiqued using empirical evidence from reported incidents, resulting in insights into areas where the theoretical perspectives of academic literature are both supported and unsupported by actual case evidence. The paper concludes with recommendations for future research directions for academic researchers.

show abstract

A Systems Dynamics View of Security Assurance Issues: "The Curse of Complexity and Avoiding Chaos"

Holstein¹

2009

2009 42nd Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Toward a Generic Model of Security in an Organizational Context: Exploring Insider Threats to Information Infrastructure

Cited by 3 publications

References 20 publications

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

An Experimental Study to Explore Attacker Response to Changes in Security and Reward

Insider Threat Behavior Factors: A Comparison of Theory with Reported Incidents

A Systems Dynamics View of Security Assurance Issues: "The Curse of Complexity and Avoiding Chaos"

Contact Info

Product

Resources

About