proactive defense of insider threats through authorization management
Among various attacks that may potentially target information systems, insider threat is recognized as an important factor of serious damage. In this paper, we investigate this problem from the view of authorizations in the context of access control. The objectives are to assess the sensitive authorizations in a system and to make appropriate arrangement for reducing the convenience of insider fraud. The proposed analytical framework takes the security constraints and the user relationships into account besides the traditional assessment of each independent user. Specially, different fraud patterns and insider attacks are formally modeled. These concerns are meaningful in practice since with the enforcement of security constraint like Separation of Duty, a single user only possesses partial privileges for a sensitive task. Thus a person who want to launch an attack need to adopt social engineering and collude with others. Based on this framework, we study the critical user problems, which find the most critical subset of users for a sensitive task, as well as discuss how to mitigate the fraud risk to the lowest level. We show that the computational complexities of these problems are NP -hard in general case but some special cases remain tractable. An approximate solution to these problems is presented.
insider threat authorization assessment