Reflecting on the Ability of Enterprise Security Policy to Address Accidental Insider Threat

Buckley, Oliver ORCID: https://orcid.org/0000-0003-1502-5721, Nurse, Jason R C, Legg, Philip A, Goldsmith, Michael and Creese, Sadie (2014) Reflecting on the Ability of Enterprise Security Policy to Address Accidental Insider Threat. In: Workshop on Socio-Technical Aspects in Security and Trust. The Institute of Electrical and Electronics Engineers (IEEE). ISBN 978-1-4799-7901-1

Full text not available from this repository. (Request a copy)

Abstract

An enterprise's information security policy is an exceptionally important control as it provides the employees of an organisation with details of what is expected of them, and what they can expect from the organisation's security teams, as well as informing the culture within that organisation. The threat from accidental insiders is a reality across all enterprises and can be extremely damaging to the systems, data and reputation of an organisation. Recent industry reports and academic literature underline the fact that the risk of accidental insider compromise is potentially more pressing than that posed by a malicious insider. In this paper we focus on the ability of enterprises' information security policies to mitigate the accidental insider threat. Specifically we perform an analysis of real-world cases of accidental insider threat to define the key reasons, actions and impacts of these events -- captured as a grounded insider threat classification scheme. This scheme is then used to performa review of a set of organisational security policies to highlight their strengths and weaknesses when considering the prevention of incidents of accidental insider compromise. We present a set of questions that can be used to analyse an existing security policy to help control the risk of the accidental insider threat.

Item Type:	Book Section
Faculty \ School:	Faculty of Science > School of Computing Sciences
UEA Research Groups:	Faculty of Science > Research Groups > Smart Emerging Technologies Faculty of Science > Research Groups > Cyber Security Privacy and Trust Laboratory
Depositing User:	Pure Connector
Date Deposited:	31 Jan 2018 10:30
Last Modified:	14 Mar 2023 08:37
URI:	https://ueaeprints.uea.ac.uk/id/eprint/66151
DOI:	10.1109/STAST.2014.10

Actions (login required)

View Item