Insider attacks in cloud computing

Proc. of the 11th IEEE Int. Conference on Trust, Security and Privacy in Computing and Communications, TrustCom-2012 - 11th IEEE Int. Conference on Ubiquitous Computing and Communications, IUCC-2012

Volumn , Issue , 2012, Pages 857-862

  Duncan, Adrian J ^a   Creese, Sadie ^a   Goldsmith, Michael ^a  

^a UNIVERSITY OF OXFORD   (United Kingdom)

Author keywords

Cloud Computing; Cloud Computing Security; Insider Attacks; Insider Threat; Malicious Insider

Indexed keywords

AMOUNT OF INFORMATION; COMPUTING ECOSYSTEMS; COMPUTING SECURITY; INSIDER ATTACK; INSIDER THREAT; MALICIOUS INSIDERS; RAPID GROWTH;

ECOSYSTEMS; UBIQUITOUS COMPUTING;

CLOUD COMPUTING;

EID: 84868152765     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/TrustCom.2012.188     Document Type: Conference Paper

References (24)

1. International Data Corporation (IDC), "The 2011 digital universe: Extracting value from chaos," Online, June 2011, http://www.emc.com/ collateral/demos/microsites/emc-digital-universe-2011/index.htm.
2. Ants Magazine, "10 valid reasons to choose cloud hosting for your business," Online, 14 February 2012, http://www.antsmagazine.com/articles/ 10-valid-reasons-to-choose-cloud-hosting-for-your-business.
3. Cloud Computing Basics, "Platform-as-a-service - 10 reasons to help you choose your saas designing platform," Online, 20 December 2011, http://cloudcomputingtechnologybasics.blogspot.com/2011/12/ten-reasons-to-help- you-choose-your.html.
4. D. Catteddu and G. Hogben, "Benefits, risks and recommendations for information security," Online, 20, November 2009, http://www.enisa.europa. eu/activities/risk-management/files/deliverables/cloud-computing-risk- assessment.
5. A. Acquisti, A. Friedman, and R. Telang, "Is there a cost to privacy breaches? an event study," in Fifth Workshop on the Economics of Information Security, 2006.
6. M. R. Randazzo, M. Keeney, E. Kowalski, D. Cappelli, and A. Moore, "Insider threat study: Illicit cyber activity in the banking and finance sector," Online, June 2005, http://oai.dtic.mil/oai/oai?verb= getRecord&metadataPrefix=html&identifier=ADA441249.
7. D. Eric and Shaw, "The role of behavioral research and profiling in malicious cyber insider investigations," Digital Investigation, vol. 3, no. 1, pp. 20-31, 2006. [Online]. Available: http://www.sciencedirect.com/science/ article/pii/S1742287606000090
8. E. Eugene and Schultz, "A framework for understanding and predicting insider attacks," Computers and Security, vol. 21, no. 6, pp. 526-531, 2002. [Online]. Available: http://www.sciencedirect.com/science/article/pii/ S016740480201009X
9. D. M. Cappelli and R. F. Trzeciak, "Best practices for mitigating insider threat: Lessons learned from 250 cases," Online, 23, April 2009, http://www.cert.org/archive/pdf/RSA-CERT-InsiderThreat.pdf.
10. R. C. Brackney and R. H. Anderson, "Understanding the insider threat," Online, March 2004, http://www.rand.org/pubs/conf-proceedings/ 2005/RAND-CF196.pdf.
11. B. E. Binde, R. McRee, and T. J. OConnor, "Assessing outbound traffic to uncover advanced persisten threat," Online, 22, May 2011, http://www.sans.edu/student-files/projects/JWP-Binde-McRee-OConnor.pdf.
12. R. Bejtlich, "What is apt and what does it want?" Online, 16, January 2010, http://taosecurity.blogspot.com/2010/01/ what-is-apt-and-what- does-it-want.html.
13. Command Five Pty Ltd., "Advanced persistent threats: A decade in review," Online, June 2011, http://www.commandfive.com/papers/C5\-APT\- ADecadeInReview.pdf.
14. S. Nicholas J. Percoco, "Data exfiltration: How data gets out," Online, 12, March 2010, http://www.networksunlimited.com/site/Portals/0/Data\ %20Exfiltration\%20How\%20Data\%20Gets\%20Out.pdf Last Accessed 23 August, 2011.
15. R. Galpin, "Death muddies greek spy probe," Online, 24, March 2006, http://news.bbc.co.uk/1/hi/world/europe/4838552.stm.
16. J. Rutkowska, "Subverting vista™ kernel for fun and profit," Online, 21, July 2006, http://www.blackhat.com/presentations/bh- usa-06/BH-US-06-Rutkowska.pdf.
17. M. Carbone, W. Lee, and D. Zamboni, "Taming virtualization," Security Privacy, IEEE, vol. 6, no. 1, pp. 65-67, Jan.-Feb. 2008.
18. S. King and P. Chen, "Subvirt: implementing malware with virtual machines," in Security and Privacy, 2006 IEEE Symposium on, may 2006, pp. 14 pp. -327.
19. D. Dai Zovi, "Hardware virtualization rootkits," BlackHat Briefings USA, 2006.
20. T. Ormandy, "An empirical study into the security exposure to hosts of hostile virtualized environments," Online, 16, April 2007, http://taviso.decsystem.org/virtsec.pdf.
21. N. MacDonald, "Hypervisor attacks in the real world," Online, 20, Febrary 2009, http://blogs.gartner.com/neil\-macdonald/2009/02/20/ hypervisor-attacks-in-the-real-world.
22. Creese, Goldsmith, Auty, and Hopkins, "Threat vectors in clouds and cascade vulnerability effects," 13, May 2010, e-Security Group, WMG, University of Warwick.
23. K. Choo, "Cloud computing: challenges and future directions," Trends & issues in crime and criminal justice, no. 400, pp. 381-400, 2010.
24. European Commission, "Commission proposes a comprehensive reform of the data protection rules," Online, 25, January 2012, http://ec.europa.eu/ justice/newsroom/data-protection/news/120125-en.htm.