A Multi-Tiered Framework for Insider Threat Prevention

Multi - Tiered Architecture for Intrusion Prevention

Today with the Internet available as a general tool, access to any publicly reachable network is a way for the legit users to leverage network resources. On the other hand, it is a way for hackers and attackers to exploit a network whether it is for competitive, financial, revenge or for that matter any malicious purpose. Intrusion prevention is a key component of any security strategy in today...

Toward an Insider Threat Detection Framework Using Honey Permissions

The insider threat remains one of the most serious challenges to computer security. An insider attack occurs when an authorized user misuses his privileges and causes damages to the organization. Deception techniques have served as a common solution to insider threat detection, and several techniques, such as approaches based on honey entities, have been proposed. On the other hand, access cont...

Defending Insider Threat

Network threat confronting organizations comes from not only outsider threat, but also insider threat. Nowadays, insider threat is widely recognized as an important issue of security management. However, tools and controls on how to fight against it are still in the research phase. Security architecture for defending insider threat is presented, which is composed of four parts: monitoring platf...

Systematizing Insider Threat mitigation

An Integrated System for Insider Threat Detection

This paper describes a proof-of-concept system for detecting insider threats. The system measures insider behavior by observing a user’s processes and threads, information about user mode and kernel mode time, network interface statistics, etc. The system is built using Microsoft’s Windows Management Instrumentation (WMI) implementation of the Web Based Enterprise Management (WBEM) standards. I...