The threat that organisations face from within is growing significantly, as it has been widely demonstrated by the harm that insiders have caused recently. For many years the security community has invested in barriers and perimeters, of increasing sophistication, designed to keep those with malign intent outside of the organisations’ information infrastructures. But assuming that one can keep ...

A secure system should exhibit all the functionality that the system designer expects and no functionality that the designer doesn’t expect. Thus whether a system is secure depends on how principals—in particular how adversarial principals—interact with the system. This set of expected adversarial interactions is defined as the threat model. Threat models are characterized of the means, motivat...

This paper investigates the autonomous decision-making process of threat detection, classiÞcation, and the selection of alternative countermeasures against threats in electronic warfare settings. We introduce a threat model that represents a speciÞc threat pattern and also present a methodology that compiles the threat into a set of rules using soft computing methods. This methodology, which is...

As insider threats pose very significant security risks to IT systems, we ask what policy-based approaches to access control can do for the detection, mitigation or countering of insider threats and insider attacks. Answering this question is difficult since little public data about insider-threat cases is available, since there is not much consensus about what the insider problem actually is, ...

This paper looks at a number of issues relating to the malicious insider and the nature of motivation, loyalty and the type of attacks that occur. The paper also examines the changing environmental, social, cultural and business issues that have resulted in an increased exposure to the insider threat. The paper then discusses a range of measures that can be taken to reduce both the likelihood o...

In the past several years there has been extensive research into honeypot technologies, primarily for detection and information gathering against external threats. However, little research has been done for one of the most dangerous threats, the advance insider, the trusted individual who knows your internal organization. These individuals are not after your systems, they are after your informa...

This paper demonstrates how to prevent or mitigate insider threats in relational databases. It shows how different order of accesses to the same data items may pose different levels of threat. Moreover, it states the conditions that are required to regard a data item as expired. In addition, it introduces the two different methods of executing insiders’ tasks, and how to prevent insider threat ...

Our decision-making processes are becoming more data driven, based on data from multiple sources, of different types, processed by a variety of technologies. As technology becomes more relevant for decision processes, the more likely they are to be subjects of attacks aimed at disrupting their execution or changing their outcome. With the increasing complexity and dependencies on technical comp...

threat assessment in the computer networks of organizations can reduce damage caused by attacks and unexpected events. data fusion models such as the jdl model provide efficient and adequate sensors to gather the right information at the right time from the right components. this information then is refined and normalized to provide situational awareness and assess events that may be intended a...