Human and Technical Security

Insider Threat

The insider threat is fundamentally a problem of human decision-making. Insiders are employees that must be trusted with access to sensitive information, and because of that trust can be a major threat. Insiders attacks are consistently catalogued as the most costly given the elevated privilege that insiders have in terms of trust and access. This makes the insider issue one of the most challenging problems in computer security.

Early work on insiders addressed non-malicious but careless insiders; people who take risks to complete tasks efficiently as possible. We developed a common pool authentication method to create cooperative risk management that allows employees to optimize for their own tasks; and also requires that they do not create excess risk for the organization.

This was built upon the concept of a risk budget. Both the analytical economic optimization and human subjects experiments indicated that a risk-based budget approach will reduce risk by changing human decision-making.

The overall focus on malicious patterns, as opposed to malicious nodes, implements an assumption that the malicious insider is not intrinsically hostile. Extending this to a complex systems approach, we model malicious behaviors that emerge over time or in response to specific conditions.

We modeled user-system interactions in a version control system as a temporal bipartite graph where interactions occur exclusively between two types of nodes, (i) users and (ii) software components. Note that the edges in this graph are only between these two types of nodes. A one-mode projection of this graph is the user graph in which two nodes (users) are connected if they have interacted at least once with the same component. Our methodology includes studying the evolution of the one-mode user graph to identify topological properties that characterize the system’s normal behavior. Among these observed properties, those that do not follow the norm of the regular pattern are assumed to indicate the presence of an anomalous event. Such an event may indicate a potential insider incident or, at least, an event that requires further investigation.

We modeled and compared the volume of interactions between users over similar or related components as opposed to non-related components over time. To capture sets of users with similar patterns of interaction, we relied on the notion of community structure to identify communities, or clusters, i.e., groups of nodes having higher probability of being connected to each other than to members of other groups. We showed that the volume of interactions between users that contribute to unrelated components increases when precipitating events are announced. This indicates the impact of precipitating events in increasing the likelihood of a change in the interacting behavior between users and components, and hints at the scale of undetected insider information exfiltration.