Understanding insider threat: A framework for characterising attacks
Nurse, Jason; Buckley, Oliver; Legg, Philip; Goldsmith, Michael; Creese, Sadie; Wright, Gordon; Whitty, Monica
Dr Phil Legg Phil.Legg@uwe.ac.uk
Associate Professor in Cyber Security
The threat that insiders pose to businesses, institu- tions and governmental organisations continues to be of serious concern. Recent industry surveys and academic literature provide unequivocal evidence to support the significance of this threat and its prevalence. Despite this, however, there is still no unifying framework to fully characterise insider attacks and to facilitate an understanding of the problem, its many components and how they all fit together. In this paper, we focus on this challenge and put forward a grounded framework for understanding and reflecting on the threat that insiders pose. Specifically, we propose a novel conceptualisation that is heavily grounded in insider- threat case studies, existing literature and relevant psychological theory. The framework identifies several key elements within the problem space, concentrating not only on noteworthy events and indicators – technical and behavioural – of potential attacks, but also on attackers (e.g., the motivation behind malicious threats and the human factors related to unintentional ones), and on the range of attacks being witnessed. The real value of our framework is in its emphasis on bringing together and defining clearly the various aspects of insider threat, all based on real- world cases and pertinent literature. This can therefore act as a platform for general understanding of the threat, and also for reflection, modelling past attacks and looking for useful patterns.
|Presentation Conference Type||Conference Paper (unpublished)|
|Start Date||May 17, 2014|
|Publication Date||Apr 10, 2014|
|Peer Reviewed||Peer Reviewed|
|APA6 Citation||Nurse, J., Buckley, O., Legg, P., Goldsmith, M., Creese, S., Wright, G., & Whitty, M. (2014, May). Understanding insider threat: A framework for characterising attacks. Paper presented at Workshop on Research for Insider Threat (Security and Privacy Workshops at IEEE Symposium on Security and Privacy)|
|Keywords||insider threat, threat framework, technical, psychological indicators, attack chain, case studies|
|Additional Information|| Additional Information : (c) 2014 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other users, including reprinting/ republishing this material for advertising or promotional purposes, creating new collective works for resale or redistribution to servers or lists, or reuse of any copyrighted components of this work in other works.
Title of Conference or Conference Proceedings : Workshop on Research for Insider Threat (Security and Privacy Workshops at IEEE Symposium on Security and Privacy)
You might also like
Tools and techniques for improving cyber situational awareness of targeted phishing attacks
Efficient and interpretable real-time malware detection using random-forest
What makes for effective visualisation in cyber situational awareness for non-expert users?