Publication details

Home Publications Publication details

A Framework For Role-Based Monitoring of Insider Misuse
Phyo AH, Furnell SM, Portilla F
Proceedings of IFIP/SEC 2004 - 18th International Conference on Information Security, Toulouse, France, 23-26 August, pp51-65, 2004

Many security incidents involve legitimate users who misuse their existing privileges, such that they have the system-level right to perform an action, but not the moral right to do so. Current Intrusion Detection Systems (IDSs) are ineffective in this context, because they do not have knowledge of user responsibilities, normal working scope of a user for a relevant position, or the separation of duties that should be enforced. This paper considers examples of the forms that misuse may take within typical applications, and then outlines a novel framework to address the problem of insider misuse monitoring. The approach argues that users with similar roles and responsibilities will exhibit similar behaviour within the system, enabling any activity that deviates from the normal profile to be flagged for further examination. The system utilises established access control principles for defining user roles, and the relationships between them, and proposes a misuse monitoring agent that will police application-level activities for signs of unauthorised behaviour.

Phyo AH, Furnell SM, Portilla F