An Architecture for Contextual Insider Threat Detection

Recent studies have shown there is a growing concern about the damage possible when trusted organization insiders behave maliciously. In particular, data exfiltration can lead to loss of revenue, damage to an organization’s reputation, and disruption of service for critical infrastructure systems. In this work, we introduce the Contextually Adaptive INsider threat architecture (CAIN), which incorporates contextual and risk-based access control with anomaly detection. While traditional Mandatory Access Control (MAC) can offer high assurance for information security, its rigid structure can hinder workers’ productivity. The goal of CAIN is to balance these dual goals of data protection and flexible access. This paper outlines the design goals of CAIN, as well as the behavior of its components. We also describe our initial design for building a prototype of our system and our future work.