Insider Threat Research Articles

Security and Privacy Perspectives of People Living in Shared Home Environments

Security and privacy (S&P) perspectives of people in a multi-user home are a growing area of research, with many researchers reflecting on the complicated power imbalance and challenging access control issues of the devices involved. However, these studies primarily focused on the multi-user scenarios in traditional family home settings, leaving other types of multi-user home environments, such as homes shared by co-habitants without a familial relationship, under-studied. This paper closes this research gap via quantitative and qualitative analysis of results from an online survey and qualitative content analysis of sampled online posts on Reddit. The study explores the complex roles of shared home users, which depend on various factors unique to the shared home environment, e.g., who owns what home devices, how home devices are used by multiple users, and more complicated relationships between the landlord and people in the shared home and among co-habitants. Half (50.7%) of our survey participants thought that devices in a shared home are less secure than in a traditional family home. This perception was found statistically significantly associated with factors such as the fear of devices being tampered with in their absence and (lack of) trust in other co-habitants and their visitors. We observed cyber-physical threats being a prominent topic discussed in Reddit posts. Our study revealed new user types and user relationships in a multi-user environment such as ExternalPrimary-InternalPrimary while analysing the landlord and shared home resident relationship with regard to shared home device use. Based on the results of the online survey and the Reddit data, we propose a threat actor model for shared home environments, which has a focus on possible malicious behaviours of current and past co-habitants of a shared home, as a special type of insider threat in a home environment. We also recommend further research to understand the complex roles co-habitants can play in navigating and adapting to a shared home environment's security and privacy landscape.

The Evolution of Identity and Access Management: Integrating Biometric and Behavioral Authentication

This article explores the transformative role of biometric and behavioral authentication in the evolving landscape of Identity and Access Management (IAM). As traditional password-based systems increasingly fail to meet the challenges posed by sophisticated cyber threats, these advanced authentication methods offer a promising solution. The article provides a comprehensive overview of physical and behavioral biometrics, examining their integration into multi-factor authentication systems and their capacity for continuous, passive user verification. It delves into the significant security benefits these technologies offer, including enhanced resistance to phishing, social engineering, and insider threats, while also highlighting the improvements in user experience and convenience. The article critically analyzes the challenges and considerations associated with implementing biometric and behavioral authentication, including privacy concerns, data security, accuracy issues, and scalability. Furthermore, it explores future directions and research opportunities in the field, such as advancements in biometric technologies, the application of machine learning and AI in behavioral analysis, and the development of context-aware authentication systems. By synthesizing current research and industry trends, this article provides valuable insights for cybersecurity professionals, IT decision-makers, and researchers interested in the future of secure and user-friendly authentication methods. It underscores the potential of biometric and behavioral authentication to significantly enhance organizational security postures while improving user satisfaction in an increasingly digital world.

Building an Impenetrable Vault: Advanced Cybersecurity Strategies for Database Servers

Organizations are relying more on database servers as storage for important information. This makes it imperative for strong measures against cyber-attack to safeguard sensitive data. The study focusses on some advanced ways of protecting database servers from cyber-crime and these are: SQL injection prevention, role-based access control, data encryption techniques, and insider threat mitigation. It also looks into the latest developments in the area such as machine learning based abnormality detection, Zero Trust architecture, and multi-factor authentication. Such practices make it possible to establish a multi-layered defensive mechanism that enhances data protection by considering the outside as well as inside dangers. Besides compliance with regulations, maintaining visibility and patch management is vital so as to remain ahead of changing cyberspace dangers. Therefore, this research presents an array of recommendations to address the entire security landscape for resilient database platforms against sophisticated assaults. The conclusions point out that there is need to amalgamate these practices towards ensuring safety in terms of risks related with contemporary database server setups. Key Words: Database Security, SQL Injection, Role-Based Access Control, Data Encryption, Insider Threat, Zero Trust Architecture.

Machine learning techniques for enhancing security in financial technology systems

The financial technology (fintech) industry has transformed the way financial services are delivered, offering enhanced convenience, accessibility, and efficiency. However, this rapid digitization has also increased the sector’s exposure to a wide array of security risks, including cyberattacks, fraudulent activities, data breaches, and insider threats. As traditional security measures struggle to keep pace with the growing sophistication of these threats, machine learning (ML) techniques have emerged as promising tools for reinforcing security in fintech systems. Machine learning models can analyze vast amounts of data, detect anomalous behavior, predict potential risks, and respond to security threats in real-time. This paper explores the potential of machine learning to enhance security in financial technology by addressing key challenges such as anomaly detection, fraud detection, intrusion detection systems (IDS), and risk management. We provide an overview of common machine learning algorithms—such as decision trees, neural networks, support vector machines (SVM), and clustering methods—that are applied to these security tasks. Additionally, we discuss the evaluation metrics used to measure the accuracy, precision, recall, and overall effectiveness of these models. Through real-world case studies, we highlight successful implementations of machine learning in fintech security, offering insights into best practices and lessons learned. Despite the many benefits, there are also significant challenges and limitations associated with the adoption of machine learning in fintech, including concerns over data privacy, the accuracy and reliability of models, and the computational resources required for large-scale deployment. Looking ahead, this paper identifies emerging trends and potential innovations that could further enhance security in fintech, from advancements in deep learning to the integration of artificial intelligence with blockchain technology. Finally, we propose areas for future research to address unresolved issues and support the continued development of machine learning-driven security solutions in the fintech industry.

Exploring the Security Challenges of an E-Voting System (EVS): A Case Study in the Bolgatanga Senior High School

The integration of electronic voting systems (EVS) into electoral processes promises increased efficiency, speed, and transparency. However, this technology also introduces a variety of security challenges that must be addressed to ensure the integrity of the voting process. This study explores the security vulnerabilities of an EVS, focusing on its implementation at Bolgatanga Senior High School (BIGBOSS). Through a case study approach, this research examines the potential threats to the administration of EVS, including issues related to data privacy, system integrity, authentication protocols, and susceptibility to cyber-attacks. A mixed-methods strategy was employed, utilizing surveys, interviews, and system tests to assess both technical vulnerabilities and user experiences. Key findings revealed Potential Voter Manipulation where unauthorized access could allow individuals to cast votes fraudulently; Insider Threats where trusted users exploiting their access could manipulate election outcomes; Weak Authentication; Lack of Robust Verification; Potential Physical Attack where individuals could vandalize machines and Vulnerabilities in Encryption which may expose votes, compromising ballot secrecy. The study recommends the implementation a blockchain-based technology , such as cryptographic techniques, consensus mechanisms, use of biometric verification to ensure the identity of voters as well as the use of digital signatures to verify the authenticity of electronic ballots and ensure that they haven't been altered during transmission, implementation of real-time monitoring of the e-voting system to detect and respond to security threats promptly” and also provide ongoing cybersecurity education and training to election officials, staff, and voters to raise awareness and reduce the risk of human error. These findings contribute to the ongoing discourse on EVS security, providing insights into practical measures for improving the reliability and safety of electronic voting systems in educational institutions and beyond.

Sentiment classification for insider threat identification using metaheuristic optimized machine learning classifiers

This study examines the formidable and complex challenge of insider threats to organizational security, addressing risks such as ransomware incidents, data breaches, and extortion attempts. The research involves six experiments utilizing email, HTTP, and file content data. To combat insider threats, emerging Natural Language Processing techniques are employed in conjunction with powerful Machine Learning classifiers, specifically XGBoost and AdaBoost. The focus is on recognizing the sentiment and context of malicious actions, which are considered less prone to change compared to commonly tracked metrics like location and time of access. To enhance detection, a term frequency-inverse document frequency-based approach is introduced, providing a more robust, adaptable, and maintainable method. Moreover, the study acknowledges the significant impact of hyperparameter selection on classifier performance and employs various contemporary optimizers, including a modified version of the red fox optimization algorithm. The proposed approach undergoes testing in three simulated scenarios using a public dataset, showcasing commendable outcomes.

Discerning Transuranic Sub-Concealments in Nuclear Waste Barrels Using γ-Ray Spectrometry: A Non-Invasive Assay Strategy To Combat the Threat of Nuclear Diversion.

Insufficient inventory control arising from inadequate monitoring procedures can lead to vulnerabilities in nuclear security. In addition, insider threats, by either malicious intent or negligence, can pose a substantial risk by exploiting such deficiencies to perform unlawful actions, such as theft or diversion, which may lead to compromised nuclear security. Interim storage barrels, intended for temporary containment of low-density nuclear waste, require special attention in this regard. In certain scenarios, the inadequacy of the existing waste barrel assay methodologies to identify and correctly measure any undesirable transuranic subconcealment present inside may pose a risk of nuclear diversion. The present work aims to establish an absolute waste barrel assay procedure to mitigate such risks by offering a robust method for the detection and assay of transuranic subconcealments in nuclear waste barrels using high-resolution γ-ray spectrometry. Challenges related to the varying amounts of attenuation experienced by the γ-rays within the subconcealments, low-density matrix, and the steel barrel wall have been addressed by an iterative photopeak efficiency transfer approach. The methodology has been verified for the assay of seven mock-up samples mimicking nuclear diversion attempts using waste barrels, for which conventional barrel scanning would be inadequate and tomographic scanning would be highly time-consuming. Using this methodology, Pu and 241Am isotopes have been assayed within <10% of the expected value for the majority, with the measurement uncertainty of <10%. The present method, which is simple and noninvasive, can identify inconsistencies with the labeled inventory and detect potential diversion attempts.

Cyber Resilience Limitations in Space Systems Design Process: Insights from Space Designers

Space technology is integral to modern critical systems, including navigation, communication, weather, financial services, and defence. Despite its significance, space infrastructure faces unique cyber resilience challenges exacerbated by the size, isolation, cost, persistence of legacy systems, and lack of comprehensive cyber resilience engineering standards. This paper examines the engineering challenges associated with incorporating cyber resilience into space design, drawing on insights and experiences from industry experts. Through qualitative interviews with engineers, cybersecurity specialists, project managers, and testers, we identified key themes in engineering methodologies, cybersecurity awareness, and the challenges of integrating cyber resilience into space projects. Participants emphasised the importance of incorporating cybersecurity considerations from the earliest stages of design, advocating for principles such as zero-trust architecture and security by design. Our findings reveal that experts favour Model-Based Systems Engineering (MBSE) and Agile methodologies, highlighting their synergy in developing flexible and resilient systems. The study also underscores the tension between principles-based standards, which offer flexibility but can lead to inconsistent implementation, and compliance-based approaches, which provide clear measures but may struggle to adapt to evolving threats. Additionally, the research recognises significant barriers to achieving cyber resilience, including insider threats, the complexity of testing and validation, and budget constraints. Effective stakeholder engagement and innovative funding models are crucial for fostering a culture of cybersecurity awareness and investment in necessary technologies. This study highlights the need for a comprehensive cyber resilience framework that integrates diverse engineering methodologies and proactive security measures, ensuring the resilience of space infrastructure against emerging cyber threats.

CYBERSECURITY PRACTICES AND FRAUD PREVENTION AMONG GHANAIAN TELECOMMUNICATION FIRMS, A MIXED METHOD ANALYSIS

This study explores the effectiveness of cybersecurity practices in preventing fraud within Ghanaian telecommunication firms, adopting a qualitative research approach to gain in-depth insights into the challenges and strategies involved. By focusing on the perspectives of key personnel directly involved in cybersecurity and fraud prevention, the study aims to uncover critical factors influencing the success of these practices. A case study design is employed, examining cybersecurity implementation across five major telecommunication firms in Ghana. The sample consists of 15 participants, including IT managers, cybersecurity officers, and fraud prevention specialists, selected through purposive sampling to ensure relevant and insightful data collection. Semi-structured interviews are used as the primary data collection method, allowing participants to provide detailed and nuanced information on their experiences with cybersecurity measures. Thematic analysis is employed to identify key patterns and themes within the data, highlighting the role of insider threats, regulatory frameworks, and employee behavior in contributing to fraud. The findings indicate that while robust technical measures such as encryption, multi-factor authentication, and intrusion detection systems play a significant role in reducing fraud, challenges in enforcement, compliance, and employee behavior remain critical barriers. The study concludes that a holistic approach, combining technical solutions with organizational culture improvements and stronger regulatory enforcement, is essential for enhancing cybersecurity effectiveness in Ghana’s telecommunication sector. Recommendations are made for improving incident response times, regulatory support, and employee training programs, as well as fostering greater collaboration between firms and regulatory bodies to strengthen fraud prevention efforts.&lt;p&gt; &lt;/p&gt;&lt;p&gt;&lt;strong&gt; Article visualizations:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;img src="/-counters-/soc/0709/a.php" alt="Hit counter" /&gt;&lt;/p&gt;

Fortifying the Cloud: Navigating Data Security Challenges and Pioneering Future-Ready Solutions

Cloud computing has transformed data storage, management, and processing, offering scalability, flexibility, and cost-efficiency. However, it presents significant security challenges. This paper examines critical data security elements in cloud computing, with a focus on maintaining confidentiality, integrity, and availability. Current security mechanisms, including encryption, identity management, firewalls, and intrusion detection, are reviewed alongside their limitations in multi-tenant environments, insecure APIs, and insider threats. Network challenges are addressed, particularly the integration of IoT, edge, and fog computing for improved security and efficiency. Emerging trends such as zero trust architecture, AI-driven security, quantum-safe encryption, and blockchain solutions are highlighted as pivotal developments. The paper underscores the need for proactive, adaptive security strategies to protect sensitive data amid evolving threats and regulatory complexities in cloud security.

CYBERSECURITY AWARENESS

Technology is advancing at a very high speed, becoming more sophisticated and complex. Similarly, due to the vastness of the digital world, cyber threats have also increased in complexity and frequency. The rapid advancement of technology has brought unprecedented conveniences but also significant risks. Therefore, security awareness is essential for every individual and organization. Cyber threats such as phishing attacks, malware attacks, social engineering, Denial of service attacks, and insider threats have become sophisticated, proving to be a challenge to individuals and organizations. This paper evaluates security awareness in the organization with a keen interest in why the program is essential, the components of the program, challenges that might be faced while implementing the program, and what role the organization and employees have to play to ensure the environment is secure. The paper provides a comprehensive analysis highlighting the importance of security awareness in an organization's current sophisticated digital world. Keywords - Security Awareness, Cyber Threats, Phishing, Malware, Social Engineering, Information Security, Cybersecurity Training, Risk Mitigation, and Continuous Education.

Machine learning approaches to detect, prevent and mitigate malicious insider threats: State-of-the-art review

Machine learning approaches to detect, prevent and mitigate malicious insider threats: State-of-the-art review

Cybersecurity Threats and Vulnerabilities in Online Banking Systems

The rapid expansion of online banking has introduced significant convenience and accessibility for consumers and financial institutions alike. However, it also brings a substantial increase in cybersecurity threats, making online banking systems prime targets for cybercriminals. This paper provides a comprehensive examination of the prevalent cybersecurity threats that online banking faces, including phishing attacks, malware, ransomware, man-in-the-middle (MITM) attacks, insider threats, and distributed denial-of-service (DDoS) attacks. We analyze these threats in-depth, exploring how each tactic is deployed to compromise security and exploit vulnerabilities within online banking systems. Moreover, this paper discusses specific vulnerabilities that exist in online banking platforms, such as weak authentication practices, insecure network connections, outdated software, and risks associated with third-party integrations. Through tables and graphical data, the paper offers a clear overview of the most common vulnerabilities and their prevalence, providing insights into how these weak points are exploited in the cyber landscape. The impact of such cybersecurity breaches on financial institutions is also considered, highlighting the consequences that follow a security breach, such as financial losses, reputational damage, regulatory fines, and customer distrust. The findings reveal that these impacts not only affect individual financial institutions but can also undermine public confidence in digital banking as a whole. Finally, the paper proposes several strategic defenses against these threats. Solutions include multi-factor authentication, end-to-end encryption, robust threat monitoring, regular security audits, and customer education initiatives, among others. Statistical data on the effectiveness of these strategies demonstrates their role in mitigating cyber risks and fortifying online banking systems against future attacks. This study concludes by emphasizing the critical need for continuous innovation in cybersecurity practices, as cyber threats continue to evolve in sophistication.

Handling imbalance dataset issue in insider threat detection using machine learning methods

Insider threats, characterized by their baleful impact and substantial costs, arise from internal factors within organizations. These threats are rare and usually unnoticed, as the malicious actions are often submerged in numerous normal activities, causing dataset imbalance and making detection hard. To address these challenges, in this paper we propose a Two-Step Insider Threat Detection (TSITD) approach. First, it preprocesses the CERT r4.2 and r5.2 datasets into day-long sequences. Second, it handles the dataset imbalance and detects threats by forming various combinations of sampling techniques and classifiers, referred to as TSITD models. When we compare these TSITD models to baseline models, we observe a significant improvement in anomaly detection rate and balanced accuracy. The TSITD models also achieve higher rankings when evaluated using the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) method.

An Enhanced RSA Algorithm to Counter Repetitive Ciphertext Threats Empowering User-centric Security

The technology-driven modern age emphasizes the security and privacy of communication. Through this paper, we delve deep into the need for user-centric security within cloud-based environments. The need for enhancement in encryption arises due to the increasing cases of data breaches and insider threats in cloud-based environments recently. The focus is laid upon the use of RSA encryption, end-to-end encryption, and anonymous messaging to address security-based concerns. The primary focus of this research is to develop a comprehensive security system to ensure the confidentiality and authenticity of text-based messages shared in the cloud. The proposed improved RSA algorithm, as suggested, incorporates three prime numbers in the key generation process. To address repetitive ciphertext, the proposed algorithm involves adding the index of each character in the plaintext string to the character’s integer value before encryption. Conversely, during decryption, the same index is subtracted. This proposed algorithm has been utilized in a practical scenario, specifically in the implementation of a chat application. This paper presents a proof-of-concept for the proposed enhanced version of the RSA algorithm, accompanied by a thorough comparison and analysis of computational times across various bit lengths. Increase in data security at a cost of minor increase in computation time was observed through this research.

Trustworthiness evaluation of workers in critical facilities using electroencephalography-based acquaintance test

This study emphasized the critical importance of prioritizing workers' trustworthiness in safeguarding critical facilities from the potential harm caused by insiders' betrayal. By noting the limitations of existing physical protection systems in critical facilities, this study showed that effectively characterizing and detecting malicious insider activity can be possible by observing immediate brain physiological reactions to specific stimuli. Based on the finding, a novel approach using electroencephalography (EEG)-based acquaintance tests was introduced to objectively assess ’a level of suspicion between colleagues by measuring their brain responses when he/she is exposed to familiar and unfamiliar stimuli. If a person claims falsely about one's acquaintance, the model assumes he/she has malicious or suspicious intent by violating the reporting obligation. The experiment was designed with a relatively short time of monitoring of less than 2 min and with a simple EEG headband device called MUSE. The experiment is to analyze whether the model could provide reliable prediction of disguised acquaintance avoiding complex preparation process. Averaged N170 peak analysis indicated that MUSE provided adequate signal characteristics to classify acquaintance. Also, a machine learning-based subject-wise classification model showed adequate capability to differentiate the EEG signals of acquaintances from unknowns. The final prediction combined multiple single-trial classification results, correctly detected the participant's acquaintance about 94.1 % of the cases, with similar performance when strangers were presented. The results indicated the possibility of using biosignal to enhance security culture and mitigate insider threats in critical facilities, by providing an indication of behavior that disregards security policies and procedures.

Enhancing cybersecurity protocols in tax accounting practices: Strategies for protecting taxpayer information

This paper highlights the importance of enhancing cybersecurity measures in tax accounting to protect taxpayer data. It proposes strategies to ensure compliance and enhance data security in the context of evolving cyber threats. This study investigated the cybersecurity landscape within the tax accounting sector, focusing on prevalent threats, the effectiveness of existing security measures, and areas for improvement. Utilizing a mixed-methods approach, the research combined qualitative interviews with cybersecurity experts and tax accounting professionals, quantitative surveys of 200 tax accounting firms, and detailed case studies of firms that experienced significant cyberattacks. The findings reveal that phishing attacks, ransomware, data breaches, malware, and insider threats are the most common cybersecurity challenges faced by tax accounting practices. While measures such as encryption, multi-factor authentication (MFA), firewalls, intrusion detection systems (IDS), regular security audits, and comprehensive employee training prove effective, their inconsistent implementation across the industry highlighted the need for standardized protocols. The study identified significant gaps in resource allocation, particularly for smaller firms and non-profits, and underscores the necessity for formal incident response plans. Recommendations include enhanced training programs, development of standardized security protocols, resource support for smaller firms, regular security audits, comprehensive incident response plans, and adoption of advanced technologies. The study calls for further exploration of emerging threats, cost-effective solutions for smaller firms, the impact of artificial intelligence (AI) and machine learning (ML), longitudinal studies on cybersecurity practices, and analysis of policy and regulatory impacts. These insights aim to enhance the cybersecurity posture of tax accounting practices, ensuring the protection of sensitive taxpayer information and overall industry resilience.

Adaptive Cybersecurity in the Digital Age: Emerging Threat Vectors and Next-Generation Defense Strategies

Abstract: This article examines the rapidly evolving landscape of cybersecurity, focusing on emerging threats and innovative defense mechanisms. We analyze four key threat vectors: Advanced Persistent Threats (APTs), ransomware, Internet of Things (IoT) vulnerabilities, and social engineering attacks. These threats pose significant risks to organizations, including data breaches, financial losses, and operational disruptions. In response, we explore cutting-edge defense mechanisms such as Artificial Intelligence and Machine Learning for threat detection, Zero Trust Architecture for access control, blockchain for data integrity, behavioral analytics for insider threat detection, and quantum cryptography for enhanced encryption. The article also outlines best practices for cybersecurity, including regular software updates, strong password policies, employee training, and security audits. By synthesizing current research and industry trends, this article provides a comprehensive overview of the cybersecurity landscape, emphasizing the need for continuous adaptation and vigilance in the face of evolving cyber threats

Lessons learned from Dread darknet communities: How and why are fraudsters targeting the elderly to be victims or accomplices?

AbstractResearch SummaryWe examined darknet user discussions on the Dread forum to identify key themes and emerging topics in fraud planning, focusing additionally on elderly victimization. Using the conceptual framework of criminogenic learning to study the process of fraud planning in darknet communities of practice, we analyzed the content of original user posts (n = 818) and comments (n = 1365) collected from the Dread forum. We identified nine unique fraud categories, of which payments‐related fraud was the most‐discussed fraud category and accounted for 25% of original user posts. We further found our sampled forum content to be dominated by the theme of learning or knowledge sharing in eight of the nine fraud categories, which appeared in more than 44% of original user posts. Our content analysis revealed specific insights into why and how darknet forum users may target people, including the elderly subpopulation, for different types of fraud. Overall, our research demonstrates the diversity of opinion and knowledge sharing among darknet forum users in relation to planning and committing fraud against the elderly, views on who is a suitable target and why, and what veteran and aspiring fraudsters consider to be important information for success in fraud.Policy ImplicationsUtilized independently or as part of a multistage strategy of darknet data analysis, our research method can be used to monitor criminally active darknet forums for current and emerging themes in fraud against general populations and vulnerable subpopulations, such as the elderly, and to develop strategies to identify, disrupt, or destroy hubs of criminal planning and knowledge sharing. Our study additionally informs policy makers of certain elder‐specific vulnerabilities that might be addressed by more up‐to‐date elder cybercrime awareness campaigns and initiatives. Our findings also highlight the presence of insider threats that may inform discussions on how health and financial institutions can better regulate these cybersecurity risks.

Investigating the Effectiveness of Graph-Based Algorithms in Identifying Insider Threats and Collusion: A Machine Learning Approach for Anomaly Detection in HR Networks

Investigating the Effectiveness of Graph-Based Algorithms in Identifying Insider Threats and Collusion: A Machine Learning Approach for Anomaly Detection in HR Networks