Methodology for choosing countermeasures against insider threats in the organization

DOI: 10.31673/2409-7292.2022.036575

Abstract

The concept of "insider threat" and "insider" is considered in the work. Common methods of cybercriminals' use of insider threats to compromise an organization's network environment to gain access to valuable assets have been identified. The variety of insider threats and their criticality for organizations to combat these threats to reduce risk are explored. It is concluded that neither approach can solve the security problem. It is noted that organizations can implement some basic measures that can reduce the number of cases of insider threats to a minimum based on a combination of formal, informal and technical measures.

Keywords: Insider, insider threat, cyber security of the organization, compromise of the network environment.

References
1. Omar M. Insider Threats: Detecting and Controlling. In New Threats and Countermeasures in Digital Crime and Cyber Terrorism; IGI Global: Hershey, PA, USA, 2015; p. 162.
2. Insider Threat, Imperva. Available online: https://www.imperva.com/learn/application-security/insider- threats (accessed on 7 May 2020).
3. Compromised Insider, The Problems It Causes Organisations? Cyberseer. Available online: https://www. cyberseer.net/solutions-and-services/common-threats/compromise-insider .
4. Clark J.; Leblanc S.; Knight S. Risks associated with USB hardware Trojan devices used by insiders. In Proceedings of the IEEE International Conference on Systems Conference (SysCon), Montreal, QC, Canada, 4–7 April 2011; pp. 201–208.
5. Potts M. Internal Network Visibility for APTs and Insider Threats. Lancope, Inc.: Alpharetta, GA, USA, 2016. Available online: https://www.insightssuccess.com/lancope-preeminent-network-visibility-and-security- intelligence/
6. Ray L.; Felch H. Detecting advanced persistent threats in oracle databases: Methods and techniques. In Strategic Information Systems and Technologies in Modern Organizations; IGI Global: Hershey, PA, USA, 2017; pp. 71–89.
7. Scott J.; Spaniel D. In 2017, The Insider Threat Epidemic Begins. Institute for Critical Infrastructure Technology, February 2017. Available online: https://icitech.org/wp-content/uploads/2017/02/ICIT-Brief-In- 2017-The-Insider-Threat-Epidemic-Begins.pdf
8. Iyer R.; Dabrowski P.; Nakka N.; Kalbarczyck Z. Pre-configurable tamper-resistant hardware support against insider threats: The tested ILLIAC approach. In Insider Attack and Cyber Security; Springer: New York, NY, USA, 2008; pp. 133–152.
9. Greitzer F.L.; Strozer J.R.; Cohen S.; Moore A.P.; Mundie D.; Cowley J. Analysis of unintentional insider threats deriving from social engineering exploits. In Proceedings of the IEEE Security and Privacy Workshops, San Jose, CA, USA, 17–18 May 2014; pp. 236–250.
10. CERT. Insider Threat Control: Using a SIEM Signature to Detect Potential Precursors to IT Sabotage. Carnegie Mellon University, Software Engineering Institute: Pittsburgh, PA, USA. Available online: https://insights.sei.cmu.edu/insider-threat/2012/01/insider-threat-control-using-a-siem-signature-to-detect-potential-precursors-to-it-sabotage.html
11. Walker-Roberts S.; Hammoudeh M.; Dehghantanha A. A systematic review of the availability and efficacy of countermeasures to internal threats in healthcare critical infrastructure. IEEE Access 2018, 6, 25167–25177.
12. Brdiczka O.; Liu J.; Price B.; Shen J.; Patil A.; Chow R.; Bart E.; Ducheneaut N. Proactive insider threat detection through graph learning and psychological context. In Proceedings of the 2012 IEEE Symposium on Security and Privacy Workshops (SPW), San Francisco, CA, USA, 24–25 May 2012; pp. 142–149.