Abstract
AbstractThe purpose of this paper is to develop an approach to analyze organizational vulnerability caused by its employees. The proposed approach is adapted from general attack graph analysis approach and social network analysis approach. The attack graph, which is relationship graph in this proposed approach, is created from organization’s email logs and virus reports. The relationship graph is analyzed using shortest path analysis to discover all possible attack paths start from risky employees to target employee, and then grouped by path length for further actions based on security policy. The proposed approach was tested using datasets that are limited to only one month with assumption that weight on all edges are equal. This paper suggested further study to improve accuracy of the proposed approach using other mathematical methods such as shortest path analysis with weight or Markov Chains. The proposed approach could also be used by security audit in risk assessment process.
Highlights
Cyber-attacks have been known since the 1960s with an objective to take control of the computer systems in an organization
The relationship graph is analyzed using shortest path analysis to discover all possible attack paths start from risky employees to target employee, and grouped by path length for further actions based on security policy
The problem of the current attack graph analysis approach has yet focus on people in an organization
Summary
Cyber-attacks have been known since the 1960s with an objective to take control of the computer systems in an organization. One of the most favorite tool is the attack graph approach which is the analysis based on tools and techniques developed from graph theory [1]–[9] This tool helps analysts visualize all vulnerabilities and all possible attack paths so they can find patterns of attacks and improve security systems. Some employees in an organization have bad behaviors when using computers or IT systems which create vulnerabilities. Since the vulnerability of people are caused by bad behaviors when using IT systems, an analysis of human behaviors is required. The main ideas of this article is to find structural approach that integrate SNA and Attack Graph Network Analysis to analyze vulnerabilities caused by people in an organization
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
