Upload File

organizational learning for insider threat detection

  • Home
  • Documents
  • Organizational learning for insider threat detection
8
Organizational Sensing for Insider Threat Detection Jeffrey M. Stanton Syracuse University School of Information Studies

Upload: syracuse-university

Post on 29-May-2015

357 views

Category:

Documents


4 download

Report

Tags:

TRANSCRIPT

Page 1: Organizational learning for insider threat detection

Organizational Sensing for Insider Threat Detection

Jeffrey M. StantonSyracuse University

School of Information Studies

Page 2: Organizational learning for insider threat detection

IT Organization as Sensor

Amazon Rank: #784,784 in Books

Makes the argument that extensive IT monitoring of employee technology use works best with high levels of employee awareness and buy-in

Page 3: Organizational learning for insider threat detection

Malicious ----------- Intentions ----------- Benevolent

Expert -------- E

xpertise ---------N

ovice

Unintentional

Insecurity

Unintentional

Insecurity

NaïveMistakes

Detrimental Misuse

BasicHygiene

Aware Assurance

Intentional Destruction

DangerousTinkering

*110 Information Security professionals generated lists of behaviors and rated them.

Page 4: Organizational learning for insider threat detection

Social Network as Sensor

Shuyuan Ho (2008) promotes the metaphor of social networks as behavioral sensors; colleagues with ample opportunity to observe a target’s behavior over time have the capability to detect unexpected changes– “anomalies” –in a target’s behavior

(Ho, S.M. (2008) Attribution-based Anomaly Detection: Trustworthiness in an Online Community. In Huan Liu, John J. Salerno and Michael J. Young, Social Computing, Behavioral Modeling, and Prediction (pp. 129-140). New York: Springer US.)

Page 5: Organizational learning for insider threat detection

Other Organizational Sensor Types

HR: Changes to benefit configurations, demographic data changes, vacation drought, travel authorizations, grievances and appeals

Finance: Changes to temporal & geographical expenditure patterns; exceptions to standard operating procedures; audit results

Procurement & Facilities: Atypical requests for equipment, software; room reservations, door swipes, ID card replacement

Page 6: Organizational learning for insider threat detection

Sensors work well when tuned to detect meaningful events and ignore meaningless ones; fusing data across multiple sensors tends to improve reliability; coordinated analysis, triggering,

response, and feedback tends to improve system performance

Page 7: Organizational learning for insider threat detection

John Seely Brown and Paul Duguid (1991):

Organizational Learning and Communities-of-Practice Learning in organizations occurs primarily within

communities of practice (COPs) – interacting groups sharing a common base of professional “stories”

Effective diagnosis of difficult problems and innovative solutions result from antiphonal recitation (Orr, 1990): sharing the story from different perspectives within the COP

Departmentalization encloses COPs within a range of related professional specializations (e.g., corporate analysis; mergers and acquisitions; equity and debt; underwriting)

Antiphonal recitation then reflects a narrowed set of perspectives; organizational learning only occurs in isolated pockets

Page 8: Organizational learning for insider threat detection

Enhancing Organizational Learning for Improved Sensing

Legitimize Peripheral ParticipationBake-in cross-training, cross-functional

teams, shadowing, externshipsEnable, reward, and celebrate

“maverick” communities


Network Security, Incident Management, and Insider … · Network Security, Incident Management, and Insider Threats ... 2. Insider Threat Agenda. ... Insider Threat Issue

INSIDER THREAT BUYERS GUIDE...BUYERS GUIDE Detect, Investigate, & Respond 2 THE RISK: INSIDER THREAT Insider threat is the fastest growing risk your organization faces, with insider

Insider Threat and Security Clearance Reform · Insider Threat and Security Clearance Reform Goal Leaders: ... • Conducted scenario-based training course for Insider Threat program

Understanding the Insider Threat

Insider threat v3

Insider Threat in IT

Radicalisation and Insider Threat

Insider Threat Mitigation (2012)

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

… the INSIDER THREAT

Mitigating the Insider Threat

The Insider Threat: Lessons Learned from Actual Insider … · The Insider Threat: Lessons Learned from Actual Insider Attacks Randall Trzeciak Insider Threat Center at CERT ... Public

Insider Threat Mitigation for U.S....Mar 19, 2021  · insider threat prevention and mitigation programs have a designated senior official with access. to the organizational head,

INSIDER THREAT - Optiv · Insider Threat Defined While insider threat has been defined in many different ways, Optiv defines insider threat as: “An insider threat is an employee,

Insider Threats - University of Pittsburgh · Unintentional Insider Threat Definition • An unintentional insider threat is (1) a currentAn unintentional insider threat is (1) a

INSIDER THREAT VIRTUAL CONFERENCE

Insider Threat Experiences

2015 VORMETRIC INSIDER THREAT REPORT · INSIDER THREAT REPORT Trends and Future Directions in Data Security Sponsoring Partners . 2015 Vormetric Insider Threat Report HealthcareRetail

Insider threat kill chain

The Accidental Insider Threat

ADVISORY: Insider Threat Competency Resource Guide · 2017-08-30 · UNCLASSIFIED Insider Threat CRG 4 UNCLASSIFIED 4. Execute insider threat awareness training requirements: Insider

Insider Threat 2 v1

2016 Insider Threat Report - Crowd Research Partnerscrowdresearchpartners.com/wp-content/uploads/2017/07/Insider... · insider threat spotlight report 5 insider threats and vulnerability

Evolving Insider Threat Detection

CYBERSECURITY - SIFMA€¦ · the insider threat at financial institutions; and (3) to help financial firms measure their insider threat program’s effectiveness. The Insider Threat

AN INTERNATIONAL SYMPOSIUM Brussels 2019insiderthreatmitigation.org/assets/docs/ITM... · become an insider threat. Effective insider threat mitigation measures and organizational

The Insider Threat

Insider threat event presentation

SureView® Insider Threat

LEGAL HURDLES TO INSIDER THREAT INFORMATION SHARING€¦ · a National Insider Threat Task Force (NITTF), required that agencies implement insider threat detection and prevention

2018 Insider Threat Report - Crowd Research Partnerscrowdresearchpartners.com/.../2017/07/Insider-Threat-Report-2018.pdf · The resulting Insider Threat Report is the most comprehensive

Cybersecurity Insider Threat Analytics

Forcepoint Insider Threat · Forcepoint Insider Threat Empowers Your Organization Forcepoint Insider Threat saves you time and effort by automatically scoring and prioritizing your

Insider Threat Summit - The Future of Insider Threat Detection

What Makes Interset Different Part 1€¦ · Insider Threat Vs Inside Threat There is a distinction to be made between an ‘insider threat’ and an ‘inside threat.’ An insider