Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics. Keywords: Insider threats, capability acquisition graphs, key challenge graphs A comprehensive model is required for understanding, reducing and preventing enterprise network attacks, and for identifying and combating system vulnerabilities and insider threats. Attacks on enterprise networks are often complex, involving multiple sites, multiple stages and the exploitation of various vulnerabilities. As a consequence, security analysts must consider massive amounts of information about network topology, system configurations, software vulnerabilities, and even social information. Integrating and analyzing all this information is an overwhelming task. A security analyst has to determine how best to represent individual components and interactions when developing a model of a computing environment. Depending on the environment and task at hand, the analyst may deal with network traffic data [15] , routing data [14] , network
Auditor Program) and demonstrate the feasibility of applying capability acquisition graphs to insider threat analysis REF .
Insider Threat Analysis Using Information-Centric Modeling
IFIP Int. Conf. Digital Forensics
Computer Science