Reflecting on the Ability of Enterprise Security Policy to Address Accidental Insider Threat

Oliver Buckley, Jason R C Nurse, Philip A Legg, Michael Goldsmith, Sadie Creese

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Citations (Scopus)

Abstract

An enterprise's information security policy is an exceptionally important control as it provides the employees of an organisation with details of what is expected of them, and what they can expect from the organisation's security teams, as well as informing the culture within that organisation. The threat from accidental insiders is a reality across all enterprises and can be extremely damaging to the systems, data and reputation of an organisation. Recent industry reports and academic literature underline the fact that the risk of accidental insider compromise is potentially more pressing than that posed by a malicious insider. In this paper we focus on the ability of enterprises' information security policies to mitigate the accidental insider threat. Specifically we perform an analysis of real-world cases of accidental insider threat to define the key reasons, actions and impacts of these events -- captured as a grounded insider threat classification scheme. This scheme is then used to performa review of a set of organisational security policies to highlight their strengths and weaknesses when considering the prevention of incidents of accidental insider compromise. We present a set of questions that can be used to analyse an existing security policy to help control the risk of the accidental insider threat.
Original languageEnglish
Title of host publicationWorkshop on Socio-Technical Aspects in Security and Trust
PublisherIEEE Conference Publications
ISBN (Electronic)978-1-4799-7901-1
DOIs
Publication statusPublished - 11 Dec 2014

Cite this