Toward a Generic Model of Security in an Organizational Context:  Exploring Insider Threats to Information Infrastructure

This paper presents a generic model for information security implementation in organizations. The model presented here is part of an ongoing research stream related to critical infrastructure protection and insider threat and attack analysis. This paper discusses the information security implementation case.

[1]  George P. Richardson,et al.  Introduction to System Dynamics Modeling with DYNAMO , 1981 .

[2]  D. Kolb.  Experiential Learning: Experience as the Source of Learning and Development , 1983 .

[3]  Joshua Klayman,et al.  Learning from feedback in probabilistic environments , 1984 .

[4]  J. Klayman.  Chapter 4 On the How and Why (not) of Learning from Outcomes , 1988 .

[5]  J. Klayman.  Cue discovery in probabilistic environments: Uncertainty and experimentation. , 1988 .

[6]  Gustavo Stubrich.  The Fifth Discipline: The Art and Practice of the Learning Organization , 1993 .

[7]  Daniel Gopher,et al.  Toward a generalization of signal detection theory to N -person games: the example of two-person safety problem , 1995 .

[8]  J. Forrester.  Industrial Dynamics , 1997 .

[9]  I. Erev,et al.  Signal detection by human observers: a cutoff reinforcement learning model of categorization decisions under uncertainty. , 1998, Psychological review.

[10]  K. R. Hammond.  Judgments Under Stress , 1999 .

[11]  Colin Camerer,et al.  Experience‐weighted Attraction Learning in Normal Form Games , 1999 .

[12]  John D. Sterman,et al.  System Dynamics: Systems Thinking and Modeling for a Complex World , 2002 .

[13]  Eugene Schultz,et al.  Incident Response: A Strategic Guide to Handling System and Network Security Breaches , 2001 .

[14]  William L. Simon,et al.  The Art of Deception: Controlling the Human Element of Security , 2001 .

[15]  Gurpreet Dhillon,et al.  Refereed Papers: Violation of Safeguards by Trusted Personnel and Understanding Related Information Security Concerns , 2001 .

[16]  Gurpreet Dhillon,et al.  Computer crimes: theorizing about the enemy within , 2001, Comput. Secur..

[17]  Paul Jones,et al.  Secrets and Lies: Digital Security in a Networked World , 2002 .

[18]  J Swanson,et al.  Business Dynamics—Systems Thinking and Modeling for a Complex World , 2002, J. Oper. Res. Soc..

[19]  E. Eugene Schultz.  A framework for understanding and predicting insider attacks , 2002, Comput. Secur..

[20]  David L. Cooke,et al.  A system dynamics analysis of the Westray mine disaster , 2003 .

[21]  Jose J. Gonzalez,et al.  A system dynamics model of an insider attack on an information system , 2003 .

[22]  Jose J. Gonzalez,et al.  The Role of Learning and Risk Perception in Compliance , 2003 .

[23]  Jose J. Gonzalez,et al.  Modeling instrumental conditioning - the behavioral regulation approach , 2003, 36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of the.

[24]  Steffen Bayer,et al.  Business dynamics: Systems thinking and modeling for a complex world , 2004 .

[25]  D. Davis,et al.  Civil Liberties vs. Security: Public Opinion in the Context of the Terrorist Attacks on America , 2004 .

[26]  David F. Andersen,et al.  Preliminary System Dynamics Maps of the Insider Cyber-threat Problem , 2004 .

[27]  Eliot H. Rich,et al.  Simulating Insider Cyber-Threat Risks : A Model-Based Case and a Case-Based Model , 2005 .

[28]  Dawn M. Cappelli,et al.  Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector , 2005 .

[29]  Sensitivity Analysis of an Infectious Disease Model , 2005 .

[30]  Stephen H. Conrad,et al.  Modeling the Emergence of Insider Threat Vulnerabilities , 2006, Proceedings of the 2006 Winter Simulation Conference.

[31]  Eliot H. Rich,et al.  Integrating Judgment and Outcome Decomposition : Exploring Outcome-based Learning Dynamics , 2006 .

[32]  Stephen H. Conrad,et al.  An Outcome-Based Learning Model to Identify Emerging Threats: Experimental and Simulation Results , 2007, 2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07).

[33]  Stephen H. Conrad,et al.  A behavioral theory of insider-threat risks: A system dynamics approach , 2008, TOMC.