Insider Threat Research Articles

Cybersecurity Implications of Edge Computing in Data Engineering

Edge computing, as an extension of cloud computing, brings computation and data storage closer to the data source. This shift offers significant advantages in terms of latency reduction, bandwidth optimization, and real-time processing capabilities. By minimizing the distance that data needs to travel, edge computing enhances the performance of applications that require rapid data processing and immediate response times. This is particularly beneficial for Internet of Things (IoT) devices, autonomous vehicles, smart grids, and other applications that demand low-latency interactions. However, the decentralization inherent in edge computing introduces a unique set of cybersecurity challenges that are distinct from those faced in traditional centralized cloud environments. The distributed architecture of edge computing creates numerous points of vulnerability, each of which can be exploited by cyber attackers. Additionally, edge devices often operate with limited computational resources and power, which complicates the implementation of robust security measures. This paper explores the cybersecurity implications of edge computing in the context of data engineering. It begins with a comprehensive review of existing literature to establish the current understanding of edge computing security issues. The review identifies the primary vulnerabilities associated with edge computing, including those related to distributed architecture, data transmission, and resource constraints. Following the literature review, the paper delves into specific security threats that edge computing environments face. These include man-in-the-middle (MitM) attacks, distributed denial-of-service (DDoS) attacks, malware and ransomware, and insider threats. Each threat is analyzed to understand its potential impact on edge computing systems and the data they process.

Insider threat detection in cyber-physical systems: a systematic literature review

The rapid expansion of cyber-physical systems (CPSs) has introduced new security challenges, leading to the emergence of various threats, attacks, and controls aimed at addressing security concerns in this evolving CPS landscape. However, a noticeable gap exists in the literature, particularly in the field of insider threat detection, which lacks a systematic review of CPS security. This study aims to comprehensively review and analyse relevant studies on insider threat detection in CPS. Employing a systematic protocol, we conducted an extensive search for pertinent articles across five prominent online databases: IEEE Xplore, Web of Science, Scopus, ACM, and ScienceDirect. The selection of these indices was based on their comprehensive coverage and the distinct relevance of their contents to our research topic. The results, guided by defined inclusion and exclusion criteria, yielded a final set of 69 included articles. Notably, 39.1 % of these articles focused on insider threat detection using specification-based methods, while 27.5 % addressed cryptography methods. Machine learning methods constituted 13.04 %, and the remaining 14.5 % included review and survey studies. Insider threats pose significant challenges in global cybersecurity, necessitating effective detection systems, methods, and tools for accurate and rapid identification. This study contributes distinct observations on the insider threat detection research topic in CPS, providing valuable insights for researchers and practitioners to expedite improvements and draw significant guidelines based on this comprehensive systematic review.

Synthesizing Information Security Policy Compliance And Non-compliance: A Comprehensive Study And Unified Framework

ABSTRACT In today’s organizational landscape, safeguarding information against both intentional and unintentional insider threats has become a paramount concern. To address this challenge, organizations formulate Information Security Policies (ISP) aimed at maximizing compliance regarding sensitive data and information. However, confining the analysis solely to compliance falls short, as even a minor fraction of non-compliant individuals can lead to significant organizational vulnerabilities. In such scenarios, it becomes imperative for organizations to delve into the intricacies that influence both ISP compliance and noncompliance. While numerous literature reviews have explored factors contributing to ISP compliance, they often treated compliance and noncompliance as mere opposites, neglecting their nuanced differences and the need for a combined perspective. Our study bridges this gap by conducting a comprehensive review of 50 peer-reviewed articles published between 2014 and 2022. This unique undertaking yields three crucial contributions: First, it elucidates the characteristics distinguishing ISP compliance and noncompliance within business contexts. Second, it provides an encompassing explication of the variables influencing both ISP compliance and noncompliance. Most notably, our review culminates in the development of a unified framework that amalgamates existing insights and charts a path for future inquiry.

Safeguarding Patient Information as an Issue Faced by Nurses: A policy brief

In an era of advancing technology, nurses find themselves at the forefront of protecting patient information. Safeguarding patient information is a critical concern in healthcare settings due to the potential adverse effects that can result from breaches or mishandling of this data. This invasion of privacy can have profound emotional, social, and financial repercussions for patients. In this article, possible and effective approaches were provided under Evolving cybersecurity threats, balancing access and privacy, human error and insider threats, education and training, interoperability and data sharing headings. Patient information security is a complex and ever-evolving challenge for nursing professionals. Nurses must remain vigilant, well-informed, and proactive in implementing cybersecurity best practices.

WZMACNIANIE ŚRODKÓW BEZPIECZEŃSTWA DLA WOJSKOWYCH BAZ LOTNICZYCH - INTEGRACJA ZAAWANSOWANYCH TECHNOLOGII I STRATEGII OPERACYJNYCH

The security of military air bases is of paramount importance in light of increasing global tensions and rapid technological advancements. The goal of this article is to investigate the protection of these critical installations by identifying significant threats, optimizing security measures, and integrating advanced technologies. The research problems of the work are presented in the form of questions: How can military air bases be protected against emerging technological threats? What are the most effective security measures for mitigating both external and internal threats? How can advanced technologies be integrated into existing security protocols to enhance overall security? The research hypothesis underscores the necessity for robust, multi-layered security systems combining physical protection, advanced technological measures, and clear operational procedures. The research methods used in the work include, among others, a comprehensive review of literature and data analysis. The study examines past incidents and current best practices. The research highlights the potential of advanced technologies such as drone surveillance, biometric access controls, and artificial intelligence to significantly enhance security. However, their successful implementation requires proper integration, continuous updates, and thorough training for personnel. The study also emphasizes the importance of balancing stringent security measures with operational efficiency, ensuring that enhanced security protocols do not impede daily operations. Internal security measures are critical, as insider threats can be as dangerous as external attacks. Stringent background checks, continuous personnel monitoring, and fostering a culture of security awareness are essential to mitigate these risks. The study calls for international cooperation to share best practices and innovations in military air base security, recognizing that these challenges are global and collaborative efforts can lead to more robust solutions. Future research should focus on developing advanced cybersecurity defenses, exploring the human factors influencing security personnel performance, and fostering international cooperation to share best practices. Integrating traditional security measures with modern technologies and international collaboration can significantly enhance the protection of military air bases, ensuring their safety and operational readiness in an increasingly volatile world. By addressing both conventional and emerging threats, this research provides actionable insights for enhancing the security of military air bases globally, ensuring their safety and operational readiness amidst evolving threats and technological landscapes.

Strengthening Fintech Security in Uganda: An Analysis of Insider Threats and Effective Risk Management Strategies

Purpose: The purpose of this study is to analyze security policies and risk management practices for reducing insider threats in the Fintech industry in Uganda. The study aims to classify and identify insider threats, examine how they relate to risk management procedures, and offer practical recommendations for improving Fintech companies’ security measures. Methodology: The study adopted a descriptive research design, focusing on diverse respondents across various sectors. Data was collected through surveys from 25 respondents, including IT security specialists, accountants, finance officers, and other relevant roles. The sectors represented included Banking and Finance (52%), Security (12%), Information Technology and Telecommunications (8% each), and others such as Agriculture, Civil Society, and Public Service (each 4%). The study employed both qualitative and quantitative data collection methods, with secondary data reviewed from existing literature and case studies. Statistical analysis was conducted using SPSS to interpret the data and identify trends in insider threat occurrences and risk management practices. Findings: The study revealed that insider threats in Uganda's Fintech sector can manifest in both physical and cyber forms. The predominant risk management practices identified include proactive measures such as robust security policies, access controls utilized by 88% of respondents, security awareness training by 80%, and continuous monitoring by 68%. Incident response and reporting procedures were also critical, ensuring that breaches are swiftly addressed to minimize impact. There was a significant positive correlation (r = .65; p < 0.05) between the frequency of past insider attacks and the regularity of risk assessments, underscoring the importance of regular evaluations in mitigating risks. Unique Contribution to Theory, Practice and Policy: The study contributes to the theoretical understanding of how local cultural attitudes and regulatory frameworks impact effectiveness of risk management strategies, providing insights that can inform RMF adaptations in similar contexts. For practitioners, it recommends development and implementation of robust security policies, employee training programs, and advanced monitoring systems. Policy-makers are advised to support regulatory frameworks that mandate regular risk assessments and the adoption of best Fintech practices.

Blockchain based secret key management for trusted platform module standard in reconfigurable platform

SummaryThe growing sophistication of cyber attacks, vulnerabilities in high computing systems and increasing dependency on cryptography to protect our digital data, make it more important to keep secret keys safe and secure. A few major issues of secret keys, like incorrect use of keys, inappropriate storage of keys, inadequate protection of keys, insecure movement of keys, lack of audit logging, insider threats and nondestruction of keys can compromise the whole security system severely. In this work, we propose a field programmable gate array (FPGA)‐based trusted platform module (TPM) framework for operating system companies and OS users, utilizing blockchain to address NIST‐recommended secret key management issues. The security processor used in OS user machines is partitioned into three areas such that processor area, confidential area, and crypto area. The isolated secret key memory in confidential area, along with a private blockchain (BC) can log the life cycle of secret keys of TPM standard. We have also implemented a special custom bus interconnect, which receives custom crypto instructions from Processing Element (PE). During the execution of crypto instructions, the architecture ensures that secret keys are present in confidential area and crypto area but never in the processor area. The movements of secret keys between confidential area, and crypto area are recorded cryptographically after the proper authentication process controlled by the proposed hardware‐based private BC framework. To the best of our knowledge, this work is the first attempt to implement a blockchain‐based framework between OS company and OS users to address NIST recommended secret key management issues of TPM standard hardware environment. The additional cost of resource usage and timing complexity we spent to implement the proposed idea is nominal. The proposed architecture is implemented with Xilinx EDA tool using FPGA board.

Data-Driven Framework for Cloud Storage Security Optimization: Leveraging Predictive Analytics and Machine Learning to Enhance Threat Detection and Incident Response

As cloud storage adoption accelerates, securing sensitive data against evolving threats, including Advanced Persistent Threats (APTs), Zero-Day Exploits, and Insider Threats, has become paramount. This research introduces a data-driven framework that harnesses predictive analytics, machine learning (ML), and deep learning (DL) techniques to fortify threat detection and incident response in cloud storage environments. By integrating real-time monitoring via Security Information and Event Management (SIEM) systems, anomaly detection using Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN), and predictive modeling through Graph-Based Anomaly Detection (GBAD), our framework identifies potential security risks and optimizes countermeasures. Leveraging ML algorithms, such as Random Forest and Support Vector Machines (SVM), our approach analyzes historical incident data, user behavior, and system logs to predict and prevent attacks. Key benefits include proactive security measures, reduced response times via Security Orchestration, Automation, and Response (SOAR), and minimized data breaches through Containerization (Docker) and Serverless Computing (AWS Lambda). This research advances the development of intelligent cloud storage security solutions, ensuring robust protection for sensitive data in cloud-based infrastructure, compliant with PCI-DSS, HIPAA, GDPR, NIST Cybersecurity Framework, and ISO 27001.

Counterintelligence Risks in Crew Management and Recruitment: The Role of Profiling and Screening in Shipping Companies

This paper examines the critical role of profiling screening in countring security threats within the maritime industry, focusing on crew management and recruitment processes.In light of the industry’s susceptibility to espionage, terrorism, and sabotage, effectivecounterintelligence measures are imperative. By scrutinizing the vulnerabilities and best practices associated with profiling screening, shipping companies can fortify their security defenses, mitigate insider threats, and ensure the safety of their assets and personnel.

Leveraging Machine Learning to Improve Access Control Mechanisms in Data Warehousing

This paper delves into integrating Machine Learning (ML) algorithms into Access Control Mechanisms (ACM) within Data Warehouses (DW) to enhance both security and operational efficiency. Traditional ACMs, notably role-based access control (RBAC), often struggle with adapting to dynamic threats and complex access patterns. ML tackles these issues by improving access decision accuracy through real-time anomaly detection and adaptive control based on user behavior and contextual insights. The study examines the implementation and benefits of ML-enhanced ACMs in DW environments, highlighting their effectiveness in mitigating unauthorized access and insider threats. This research also addresses critical considerations, such as privacy protections and the interpretability of ML models, crucial for maintaining regulatory compliance and stakeholder trust. Ultimately, this study emphasizes ML's pivotal contribution to advancing security practices within Data Warehouses (DWs) and proposes future research directions to enhance adaptive security measures in evolving digital landscapes.

ITRPL: An intelligent and trusted RPL protocol based on Multi-Agent Reinforcement Learning

Routing Protocol for Low Power and Lossy Networks (RPL) is the de-facto routing standard in IoT networks. It enables nodes to collaborate and autonomously build ad-hoc networks modeled by tree-like destination-oriented direct acyclic graphs (DODAG). Despite its widespread usage in industry and healthcare domains, RPL is susceptible to insider attacks. Although the state-of-the-art RPL ensures that only authenticated nodes participate in DODAG, such hard security measures are still inadequate to prevent insider threats. This entails a need to integrate soft security mechanisms to support decision-making. This paper proposes iTRPL, an intelligent and behavior-based framework that incorporates trust to segregate honest and malicious nodes within a DODAG. It also leverages multi-agent reinforcement learning (MARL) to make autonomous decisions concerning the DODAG. The framework enables a parent node to compute the trust for its child and decide if the latter can join the DODAG. It tracks the behavior of the child node, updates the trust, computes the rewards (or penalties), and shares them with the root. The root aggregates the rewards/penalties of all nodes, computes the overall return, and decides via its ϵ-Greedy MARL module if the DODAG will be retained or modified for the future. A simulation-based performance evaluation demonstrates that iTRPL learns to make optimal decisions with time.

Unveiling Human Factors: Aligning Facets of Cybersecurity Leadership, Insider Threats, and Arsonist Attributes to Reduce Cyber Risk

This qualitative study is a systematic literature review (draws on literature primarily published within the last five years) addresses a comprehensive approach to a crucial but often overlooked aspect of cybersecurity: the human factors underlying insider threats. Attention is focused on the so-called “organizational arsonists” – individuals who willfully seek to adversely impact the organization by inducing anarchy aligned with their own motivations, insiders who purposefully damage their companies using digital methods, someone intentionally causing mayhem within a company, which can be criminal in cyber environments. The purpose of the research is to identify how cybersecurity leadership can effectively detect and mitigate the risks associated with insiders, particularly those exhibiting arsonist-like behaviors. Review uncovering that organizational arsonists can escalate cybersecurity risks substantially, with insider incidents costing organizations an average of $16.2 million per incident. These incidents now represent a persistent challenge, increasing in frequency by 68% over the past year according to the 2022 Insider Threat Report. The findings highlight the necessity of leadership strategies that preemptively recognize and neutralize potential insider threats to improve organizational resilience and security posture. This approach not only informs current cybersecurity practices but also aids in the development of targeted policies and refined regulatory measures. By integrating insights from psychology, criminology, and cybersecurity, the study provides a comprehensive understanding of the human elements influencing insider threats, essential for enhancing both academic knowledge and practical applications in risk management. The results showed a parallel between the motivations of arsonists who set physical fires to the characteristics and motivations of insider threats who exploit organizational vulnerabilities. The impact of this research can be helpful in assisting cybersecurity professionals, leaders who strategize against cyber threats, and risk managers and analysts who understand and mitigate human factors and insider threats. Leaders and executives may use these insights to improve security resource allocation and culture. Policymakers and regulators may use the study’s results to create more nuanced cybersecurity legislation, while academics and students in related disciplines can use it for future research.

Cybersecurity Law: Challenges and Legal Frameworks for Protecting Digital Assets and Privacy Rights

Provides an overview of the complex landscape of cybersecurity law, highlighting the challenges and legal frameworks aimed at safeguarding digital assets and privacy rights in an increasingly interconnected and digital world. the evolving nature of cybersecurity threats, the legal principles underpinning cybersecurity regulation, and the tensions between security imperatives and individual rights. Cybersecurity law encompasses a broad range of legal principles, regulations, and policies designed to protect digital assets, information systems, and privacy rights from cyber threats and attacks. the multifaceted nature of cybersecurity challenges, including data breaches, malware attacks, ransomware, insider threats, and state-sponsored cyber espionage, which pose significant risks to individuals, organizations, and governments worldwide.

An intelligent security mechanism in mobile Ad-Hoc networks using precision probability genetic algorithms (PPGA) and deep learning technique (Stacked LSTM)

The Mobile Ad-hoc Networks (MANETs) have gained a significant attention in the recent years due to their proliferation and huge application purposes. To defend from many types of modern cyber dangers like Distributed Denial of Service (DDoS) attacks, Advanced Persistent Threats (APTs), Insider Threats, Ransomware, Zero-Day Exploits, Social Engineering tactics, and etc is not easy when it comes to keeping MANETs security. These complex assaults focus on network infrastructure, take advantage of weaknesses in communication protocols and control user actions. Although there have been improvements in intrusion detection systems (IDS), it is still difficult to fully safeguard MANETs. The purpose of this research is to create advanced methods that can accurately find and decrease attacks inside MANETs. Applying Sensor-based Feature Extraction (SFE) to extract useful network features such as Received Signal Strength Indication (RSSI) and Time of Travel (TOT) from datasets NSL-KDD and CICIDS-2017. Utilizing the fresh method of Precise Probability Genetic Algorithm (PPGA) optimization for removing unrelated details, which enhances precision in detecting attacks. Predicting normal and attacking labels by applying Stacked Recurrent Long Short Term Memory (SRLSTM) method, fine-tuning classifier's parameters in every layer to improve outcomes. In order to authenticate and compare the suggested methods with current attack detection tactics, this study will make use of various evaluation measurements. The NSL-KDD, which is a benchmark dataset in network intrusion detection research, has a wide variety of network traffic data with instances that are labeled as normal and different attacks. CICIDS-2017 is similar because it contains an extensive dataset too - this includes real-world traces from network traffic where there's both regular activity and harmful actions. The purpose is to enhance the existing status of MANET security so as it can withstand more strongly against cyber dangers. According to the outcomes, it is analyzed that the attack detection accuracy has improved greatly 99 % when compared to other methods, as shown by the detailed assessment measurements. Better handling of big datasets with top detection accuracy reduces the time needed 8.9 s for training and testing models. Decrease in misclassification results and better ability to differentiate normal network actions from harmful intrusions. Improved resistance of MANETs to different cyber dangers, guaranteeing the safety and dependability of network communication in changing and non-centralized settings.

Cyber Evaluation and Management Toolkit (CEMT): Face Validity of Model-Based Cybersecurity Decision Making

The Cyber Evaluation and Management Toolkit (CEMT) is an open-source university research-based plugin for commercial digital model-based systems engineering tools that streamlines conducting cybersecurity risk evaluations for complex cyber-physical systems. The authors developed this research tool to assist the Australian Defence Force (ADF) with the cybersecurity evaluation of complicated systems operating in an increasingly contested and complex cyber environment. This paper briefly outlines the functionality of the CEMT including the inputs, methodology, and outputs required to apply the toolkit using a sample model of the process applied to a generic insider threat attack. A face validity trial was conducted on the CEMT, surveying subject-matter experts in the field of complex cybersecurity analysis and risk assessment to present the generic case study and gather data on the expected benefits of a real-world implementation of the process. The results of the face validity broadly supports the effectiveness and usability of the CEMT, providing justification for industry research trials of the CEMT.

SECURITY IN CLOUD COMPUTING

By offering scalable and easily available computer resources over the internet, cloud computing has radically changed IT infrastructures all around. Ensuring the security of cloud systems remains a major difficulty even if they are used widely in many different fields. This abstract explores the intricate elements of cloud computing security including technical advancement, challenges, and methods. Data breaches, insider threats, and compliance complexities are among the main challenges; strong protections like authentication, authorization, and encryption will help to maintain data integrity and security. By redefining trust models and access restrictions in cloud systems, blockchain and zero-trust architecture are absolutely essential in increasing security. Emphasizing the importance of tying security measures with legal obligations, regulatory compliance systems such GDPR, HIPAA, and ISO/IEC 27001 set rigorous demands on cloud providers and users. Service level agreements (SLAs) help to define and explain providers' and customers' security obligations. They list procedures for problem resolution and service guarantees. This abstract ends with stressing the always shifting nature of challenges in cloud security and the pressing need of adaptive security solutions to effectively lower developing hazards. It offers a whole view that is absolutely essential for comprehending and controlling the complexity of protecting cloud computing systems.

Международный опыт применения управленческих технологий в системе государственного управления

This article examines the impact of innovation on public administration and planning in the context of comparative analysis. The author emphasizes key aspects such as the development of digital technologies, ensuring the availability of information, increasing citizen participation and protecting data privacy. The main focus is on analytics to ensure public safety, counter insider threats, human resource management and urban infrastructure development. Methods for utilizing Big Data and artificial intelligence in public administration are presented, along with outcomes from governmental projects based on Big Data. It is noted that the collection and analysis of vast amounts of statistical information allows authorities to develop targeted support programs for specific social groups, optimize urban infrastructure and transport, and improve public safety by identifying financial crimes and illegal activities. Furthermore, the introduction of big data technologies can bring the quality of public services to a new level and make the political decision-making process more transparent and citizen-centric.

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

The escalating risk of cyber threats requires continuous advances in security monitoring techniques. This survey paper provides a comprehensive overview of recent research into novel methods for cyber threat detection, encompassing diverse approaches such as machine learning, artificial intelligence, behavioral analysis and anomaly detection. Machine learning plays a central role in cyber threat detection, highlighting the effectiveness of deep neural networks in identifying evolving threats. Their adaptability to changing attack patterns is emphasized, underlining their importance for real-time security monitoring. In parallel, ensemble learning is explored, combining multiple models to improve overall detection accuracy and create a robust defense against a spectrum of cyber threats. The literature reviewed highlights the importance of behavioral analysis, with a novel approach that integrates user behaviour profiling with anomaly detection. This has proven effective in identifying suspicious activity within a network, particularly insider threats and stealthy attacks. Another behavioral framework using User and Entity Behavior Analytics (UEBA) is presented for enhanced anomaly detection, highlighting the importance of context-aware monitoring in improving threat detection accuracy. Collaborative defense mechanisms emerge as a major focus of the research papers reviewed, exploring the potential of sharing threat information between organisations to enhance collective security monitoring. Their findings underscore the importance of a collaborative approach to staying ahead of rapidly evolving cyber threats. Some types of cyber-attacks are also analysed in the context of a security operations centre (SOC) monitoring environment using a security information and event management (SIEM) tool - Splunk. In conclusion, this survey paper synthesizes recent advances in cyber threat detection methods in security monitoring that integrate machine learning, behavioral analysis, and collaborative defense strategies. As cyber threats continue to evolve, these novel methods provide valuable insights for researchers, practitioners, and organisations seeking to strengthen their cybersecurity defenses. This concise overview emphasises the multi-dimensional approach required to secure digital ecosystems, providing a concise yet comprehensive guide to modern cyber threat detection strategies.

Privileged User Behavior Analytics (PUBA) for Insider Threat Detection

Privileged User Behavior Analytics (PUBA) for Insider Threat Detection

Assessing the Vulnerabilities: Cybersecurity Challenges in Power System Infrastructure in Nigeria

This study examined the Cyber security Challenges in Power System Infrastructure in Nigeria. Four research questions guided the study which employed a survey research design. The population of the study was 46 respondents comprising 23 Technical Units Heads and 23 Heads of Cyber security Units from the (23) power-generating plants in Nigeria. The entire population was used hence, there was no sampling. The instrument used for data collection was a structured questionnaire titled: Cyber security Challenges in Power System Infrastructure Questionnaire (CCPSIQ) developed by the researchers. A reliability index of 0.89 was obtained using the Cronbach Alpha reliability method. The mean statistic was used to answer the research questions. The findings of the study revealed that the primary cyber threats targeting power system infrastructure in Nigeria including network-based attacks, insider threats, supply chain vulnerabilities, advanced persistent threats (APTs), physical attacks, zero-day exploits, data breaches, and ransom ware/extortion; it further reveal that cyber-attacks on power grid infrastructure in Nigeria lead to significant service disruptions, financial losses, equipment damage, safety compromises, erosion of customer confidence, regulatory non-compliance, increased vulnerability to future incidents, reputation damage, and prolonged recovery periods, underscoring the multifaceted impact of cyber threats on operational efficiency. The study recommended that: Collaboration among stakeholders, including government agencies, industry partners, and cyber security experts, is paramount to effectively address emerging threats and enhance cyber security resilience. By implementing proactive measures and fostering a culture of cyber security awareness, Nigeria can strengthen its power system infrastructure against cyber threats, safeguarding the reliability and security of critical services for its citizens.