A Framework For Monitoring Insider Misuse Of It Applications

Many security incidents involve legitimate users who misuse their existing privileges, such that they have the system-level right to perform an action, but not the moral or ethical rights to do so. Current Intrusion Detection Systems are ineffective in this context, because they do not have knowledge of user responsibilities, the normal working scope for a particular position, or the separation of duties that should be enforced. This paper outlines a novel framework for solving the problem of insider misuse monitoring. The approach argues that users with similar roles and responsibilities will exhibit similar behaviour within the system, enabling any activity that deviates from the normal profile to be flagged for further examination. Established access control principles are utilised for defining user roles, and the relationships between them, and a misuse-monitoring agent is proposed that will police applicationlevel activities for signs of unauthorised behaviour. Practical implementation of the conceptual framework is considered in the context of a database environment.