Managing Malicious Insider Risk through BANDIT

The transition from system-to information-based security has continued steadily over the last 30 years. Correspondingly, it is increasingly not the computer that is at risk, but the information in it. The human operator is ultimately the cornerstone of information security, an integral part of the information infrastructure. We are therefore forced to use techniques and methods that help us understand the role of human actors in the information infrastructure, so that we may make meaningful progress in mitigating insider threat. Malicious versus benign human behavior cannot easily be categorized based on a signature such as conventional virus and intrusion detection approaches. Because the cost of a false positive is high, we must be careful in our classification and subsequent actions. This article outlines our BANDIT (Behavioral Anomaly Detection for Insider Threat) system, using the traditional notion of Motive, Means, and Opportunity, combined with comprehensive behavioral analysis techniques to place each individual on a sliding scale of 'insider risk'. Finally, an insider threat detection cost-benefit analysis, based on classical risk assessment techniques, is presented to quantify how effective the technology has to be for beneficial deployment in a given enterprise.

1. Introduction

As our communication infrastructure has become more ubiquitous, we have shifted the implementation of our business processes increasingly to this information infrastructure. Things that in the past required a phone call are now available over email, chat, or solid media. Documents have moved from filing cabinets to file shares, customer rolodexes to databases, and accounting books to spreadsheets. A filing cabinet, however, is often much less accessible than a networked server. The network security industry has therefore been profiting handsomely from the sale of access control and security solutions, which work very well[2] as long as the insider is trustworthy.