Currently governments and research communities are concentrating on insider threat matters more than ever, the main reason for this is that the effect of a malicious insider threat is greater than before. Moreover, leaks and the selling of the mass data have become easier, with the use of the dark web. Malicious insiders can leak confidential data while remaining anonymous. Our approach describes the information gained by looking into insider security threats from the multiple perspective concepts that is based on an integrated three-dimensional approach. The three dimensions are human issue, technology factor, and organisation aspect that forms one risk prediction solution. In the first part of this thesis, we give an overview of the various basic characteristics of insider cyber-security threats. We also consider current approaches and controls of mitigating the level of such threats by broadly classifying them in two categories: a) technical mitigation approaches, and b) non-technical mitigation approaches. We review case studies of insider crimes to understand how authorised users could harm their organisations by dividing these cases into seven groups based on insider threat categories as follows: a) insider IT sabotage, b) insider IT fraud, c) insider theft of intellectual property, d) insider social engineering, e) unintentional insider threat incident, f) insider in cloud computing, and g) insider national security. In the second part of this thesis, we present a novel approach to predict malicious insider threats before the breach takes place. A prediction model was first developed based on the outcomes of the research literature which highlighted main prediction factors with the insider indicator variables. Then Bayesian network statistical methods were used to implement and test the proposed model by using dummy data. A survey was conducted to collect real data from a single organisation. Then a risk level and prediction for each authorised user within the organisation were analysed and measured. Dynamic Bayesian network model was also proposed in this thesis to predict insider threats for a period of time, based on data collected and analysed on different time scales by adding time series factors to the previous model. Results of the verification test comparing the output of 61 cases from the education sector prediction model show a good consistence. The correlation was generally around R-squared =0.87 which indicates an acceptable fit in this area of research. From the result we expected that the approach will be a useful tool for security experts. It provides organisations with an insider threat risk assessment to each authorised user and also organisations can discover their weakness area that needs attention in dealing with insider threat. Moreover, we expect the model to be useful to the researcher's community as the basis for understanding and future research.

In recent years, there has been a significant increase in insider threats within organisations and these have caused massive losses and damages. Due to the fact that email communications are a crucial part of the modern-day working environment, many insider threats exist within organisations’ email infrastructure. It is a well-known fact that employees not only dispatch ‘business-as-usual’ emails, but also emails that are completely unrelated to company business, perhaps even involving malicious activity and unethical behaviour. Such insider threat activities are mostly caused by employees who have legitimate access to their organisation’s resources, servers, and non-public data. However, these same employees abuse their privileges for personal gain or even to inflict malicious damage on the employer. The problem is that the high volume and velocity of email communication make it virtually impossible to minimise the risk of insider threat activities, by using techniques such as filtering and rule-based systems. The research presented in this dissertation suggests strategies to minimise the risk of insider threat via email systems by employing a machine-learning-based approach. This is done by studying and creating categories of malicious behaviours posed by insiders, and mapping these to phrases that would appear in email communications. Furthermore, a large email dataset is classified according to behavioural characteristics of employees. Machine learning algorithms are employed to identify commonly occurring insider threats and to group the occurrences according to insider threat classifications. / Dissertation (MSc (Computer Science))--University of Pretoria, 2020. / Computer Science / MSc (Computer Science) / Unrestricted

Organisations such as governments and healthcare bodies are increasingly responsible for managing large amounts of personal information, and the increasing complexity of modern information systems is causing growing concerns about the protection of these assets from insider threats. Insider threats are very difficult to handle, because the insiders have direct access to information and are trusted by their organisations. The nature of insider privacy breaches varies with the organisation’s acceptable usage policy and the attributes of an insider. However, the level of risk that insiders pose depends on insider breach scenarios including their access patterns and contextual information, such as timing of access. Protection from insider threats is a newly emerging research area, and thus, only few approaches are available that systemise the continuous monitoring of dynamic insider usage characteristics and adaptation depending on the level of risk. The aim of this research is to develop a formal framework for an adaptive early warning and response system for insider privacy breaches within dynamic software systems. This framework will allow the specification of multiple policies at different risk levels, depending on event patterns, timing constraints, and the enforcement of adaptive response actions, to interrupt insider activity. Our framework is based on Usage Control (UCON), a comprehensive model that controls previous, ongoing, and subsequent resource usage. We extend UCON to include interrupt policy decisions, in which multiple policy decisions can be expressed at different risk levels. In particular, interrupt policy decisions can be dynamically adapted upon the occurrence of an event or over time. We propose a computational model that represents the concurrent behaviour of an adaptive early warning and response system in the form of statechart. In addition, we propose a Privacy Breach Specification Language (PBSL) based on this computational model, in which event patterns, timing constraints, and the triggered early warning level are expressed in the form of policy rules. The main features of PBSL are its expressiveness, simplicity, practicality, and formal semantics. The formal semantics of the PBSL, together with a model of the mechanisms enforcing the policies, is given in an operational style. Enforcement mechanisms, which are defined by the outcomes of the policy rules, influence the system state by mutually interacting between the policy rules and the system behaviour. We demonstrate the use of this PBSL with a case study from the e-government domain that includes some real-world insider breach scenarios. The formal framework utilises a tool that supports the animation of the enforcement and policy models. This tool also supports the model checking used to formally verify the safety and progress properties of the system over the policy and the enforcement specifications.

The mitigation of insider threats against databases is a challenging problem since insiders often have legitimate privileges to access sensitive data. Conventional security mechanisms, such as authentication and access control, are thus insufficient for the protection of databases against insider threats; such mechanisms need to be complemented with real-time anomaly detection techniques. Since the malicious activities aiming at stealing data may consist of multiple steps executed across temporal intervals, database anomaly detection is required to track users' actions across time in order to detect correlated actions that collectively indicate the occurrence of anomalies. The existing real-time anomaly detection techniques for databases can detect anomalies in the patterns of referencing the database entities, i.e., tables and columns, but are unable to detect the increase in the sizes of data retrieved by queries; neither can they detect changes in the users' data access frequencies. According to recent security reports, such changes are indicators of potential data misuse and may be the result of malicious intents for stealing or corrupting the data. In this thesis, we present techniques for monitoring database accesses and detecting anomalies that are considered early signs of data misuse by insiders. Our techniques are able to track the data retrieved by queries and sequences of queries, the frequencies of execution of periodic queries and the frequencies of referencing the database tuples and tables. We provide detailed algorithms and data structures that support the implementation of our techniques and the results of the evaluation of their implementation.<br>

Organisationer står idag inför flera olika hot mot deras IT-säkerhet där ett av de vanligaste hoten är skadliga användarbeteenden som främst orsakas av interna användare. Det kan vara svårt att veta för organisationer vad för användarbeteenden som kan utgöra ett hot samt vilka orsaker som kan bidrar till dessa beteenden. Det är i dagens samhälle viktigt för organisationer att förbereda sig samt vara medvetna om de hot en användare utgör för att kunna vidta de rätta åtgärderna om det skulle uppstå. Syftet med denna studie är att undersöka vilka orsaker till användarnas beteenden som utgör ett hot för en organisations IT-säkerhet och vilka åtgärder som har vidtagits. En kvalitativ metod i form av fem olika intervjuer har valts där en intervjuguide låg som grund till intervjufrågorna. En individuell intervju hölls med en användare av Högskolan i Borås samt en gruppintervju med IT-avdelningen från Högskolan i Borås. Studien resulterade i att 10 användarbeteenden, 25 orsaker och 22 vidtagna åtgärder framkom samt att det finns relationer mellan dem. Det kan vara svårt för organisationer att vara helt förberedda på hot men det är enligt vår studie möjligt att identifiera användarbeteenden, orsaker samt åtgärder. Med utbildning kan organisationer göra sina användare mer säkerhetsmedvetna och därmed minska riskerna för de skador användarbeteenden kan utgöra. / Organizations today are facing several different threats to their IT security where one of the most common threats is malicious user behaviors that are mainly caused by internal users. It can be difficult for organizations to know what user behaviors can pose a threat and what causes can contribute to these behaviors. In today's society, it is important for organizations to prepare and be aware of the threats a user poses in order to be able to take the right measures if they should arise. The language of this study is written in swedish and the purpose of this study is to investigate what causes in users' behavior constitute a threat to an organization's IT security and what measures have been taken. A qualitative method in the form of five different interviews has been chosen where an interview guide was the basis for the interview questions. An individual interview was held with a user of the University of Borås and a group interview with the IT department from the University of Borås. The study resulted in 10 user behaviors, 25 causes and 22 measures taken and that there are connections and relationships between them. It can be difficult for organizations to be fully prepared for threats, but according to our study it is possible to identify user behaviors, causes and measures. With education, organizations can make their users more security-conscious and thus reduce the risks of the damage that user behavior can cause.

IT systems that contain large volumes of information are today extremely valuable to organizations. As the IT systems grow bigger, more challenges are emerging, vulnerability increases and control decreases. Organizations are using IT security to protect their IT systems from different threats and the human factor can be seen as one of the biggest risks towards IT security. Therefore it is not optimal to only focus on the technical solutions and measures, the focus should also be on the employees IT security knowledge and IT security awareness. To increase the knowledge of IT security and to make the employees more IT security aware requires continuous work and IT security education is often mentioned as a factor to increase IT security- knowledge and awareness. Despite this, challenges are mentioned in previous research, which means that even if an employee participates in an IT security education, the organizations can not take for granted that their employees have gained IT security knowledge or know how to act more security aware. IT security education, IT security knowledge and IT security is mentioned as three factors that can affect IT security. Three research questions were intended to be answered within this research with the purpose to investigate if these factors increase each other. Three hypotheses were also forming the basis for answering the research questions. With a quantitative method and questionnaire this research reached out to 158 employees at different Swedish branches within machine manufacturing, advertising, municipal work and sales industry. Results showed that one of the three hypotheses was accepted and the other two hypotheses were not accepted. This result also gave answers to the research questions regarding that IT security education does not increase IT security knowledge, IT security knowledge does not increase IT security awareness but IT security education increases IT security awareness.

<p>Advances in Artificial Intelligence (AI), or more precisely on Neural Networks (NNs), and fast processing technologies (e.g. Graphic Processing Units or GPUs) in recent years have positioned NNs as one of the main machine learning algorithms used to solved a diversity of problems in both academia and the industry. While they have been proved to be effective in solving many tasks, the lack of security guarantees and understanding of their internal processing disrupts their wide adoption in general and cybersecurity-related applications. In this dissertation, we present the findings of a comprehensive study aimed to enable the absorption of state-of-the-art NN algorithms in the development of enterprise solutions. Specifically, this dissertation focuses on (1) the development of defensive mechanisms to protect NNs against adversarial attacks and (2) application of NN models for anomaly detection in enterprise networks.</p><p>In this state of affairs, this work makes the following contributions. First, we performed a thorough study of the different adversarial attacks against NNs. We concentrate on the attacks referred to as trojan attacks and introduce a novel model hardening method that removes any trojan (i.e. misbehavior) inserted to the NN models at training time. We carefully evaluate our method and establish the correct metrics to test the efficiency of defensive methods against these types of attacks: (1) accuracy with benign data, (2) attack success rate, and (3) accuracy with adversarial data. Prior work evaluates their solutions using the first two metrics only, which do not suffice to guarantee robustness against untargeted attacks. Our method is compared with the state-of-the-art. The obtained results show our method outperforms it. Second, we proposed a novel approach to detect anomalies using LSTM-based models. Our method analyzes at runtime the event sequences generated by the Endpoint Detection and Response (EDR) system of a renowned security company running and efficiently detects uncommon patterns. The new detecting method is compared with the EDR system. The results show that our method achieves a higher detection rate. Finally, we present a Moving Target Defense technique that smartly reacts upon the detection of anomalies so as to also mitigate the detected attacks. The technique efficiently replaces the entire stack of virtual nodes, making ongoing attacks in the system ineffective.</p><p> </p>