Unintentional insider threat: Contributing factors, observables, and mitigation strategies

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2014, Pages 2025-2034

  Greitzer, Frank L ^a   Strozer, Jeremy ^b   Cohen, Sholom ^b   Bergey, John ^b   Cowley, Jennifer ^b   Moore, Andrew ^b   Mundie, David ^b  

^a PsyberAnalytix ^*  (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CONTRIBUTING FACTOR; INDUSTRY STAKEHOLDERS; INSIDER THREAT; MITIGATION STRATEGY; OPERATIONAL DEFINITION;

SYSTEMS SCIENCE;

EID: 84902270476     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2014.256     Document Type: Conference Paper

References (47)

1. AlgoSec, "The State of Network Security 2013: Attitudes and Opinions," AlgoSec, Inc., 2013.
2. CERT Insider Threat Team, Unintentional Insider Threats: A Foundational Study (CMU/SEI-2013-TN-022), Software Engineering Institute, Carnegie Mellon University, May 2013.
3. D. J. Pond and K.R. Leifheit, "End of an Error," Security Management, 47(5), 2003, pp. 113-117.
4. S. Leka, A. Griffiths, and T. Cox, "Work Organization and Stress: Systematic Problem Approaches for Employers, Managers, and Trade Union Representatives," Protecting Workers Health Series, No. 3, World Health Organization, Geneva, Switzerland, 2004. http://www.who.int/occupational-health/ publications/pwh3rev.pdf
5. P. Lehner, M. Seyed-Solorforough, M.F. O'Connor, S. Sak, and T. Mullin, "Cognitive Biases and Time Stress in Team Decision Making," IEEE Transactions on Systems, Man, and Cybernetics Part A: Systems & Humans, 27, 1997, pp. 698-703.
6. E. Soetens, J. Hueting, and F. Wauters, "Traces of Fatigue in an Attention Task," Bulletin of the Psychonomic Society, 30, 1992, pp. 97-100.
7. A. Vishwanath, T. Herath, R. Chen, J. Wang, and H. Rao, "Why Do People Get Phished? Testing Individual Differences in Phishing Vulnerability within an Integrated, Information Processing Model," Decision Support Systems, 51(3), 2011, pp. 576-586.
8. A. Whitten, and J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0," Proceedings of the 8th USENIX Security Symposium, Washington, D.C., 1999.
9. V. Venkatesh, M. Morris, G.B. Davis, and F.D. Davis, "User Acceptance of Information Technology: Toward a Unified View," MIS Quarterly, 27(3), 2003, pp. 425-478.
10. J. Erkkila, "Why We Fall for Phishing," Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI) Vancouver, BC, Canada, May 7-12, 2011, ACM, 2011.
11. S. Sheng, M. Holbrook, P. Kumaraguru, L. Cranor, and J. Downs, "Who Falls for Phish? A Demographic Analysis of Phishing Susceptibility and Effectiveness of Interventions," 28th ACM Conference on Human Factors in Computing Systems, Atlanta, GA, April 10-15, 2010, ACM 2010.
12. B.K. Houston, "Noise, Task Difficulty, and Stroop Color-Word Performance," Journal of Experimental Psychology 82, 2, 1969, pp. 403-404.
13. A. Stokes, and K. Kite, Flight Stress, Ashgate, 1994.
14. D.R. Davies, and R. Parasuraman, The Psychology of Vigilance, Academic Press, 1982.
15. G.R.J. Hockey, "Changes in Operator Efficiency as a Function of Environmental Stress, Fatigue, and Circadian Rhythms," in K.R. Boff, L. Kaufman, and J.P. Thomas, (Eds.), Handbook of Perception and Human Performance (Vol. 2), Wiley, 1986.
16. P.L. Wachtel, "Anxiety, Attention and Coping with Threat," Journal of Abnormal Psychology 73, 2, April 1968, pp. 137-143.
17. M.R. Endsley, "Toward a Theory of Situation Awareness in Dynamic Systems," Human Factors, 37, 32-64, 1995.
18. M.D. Rodgers, R.H. Mogfor, and B. Strauch, "Post Hoc Assessment of Situation Awareness in Air Traffic Control Incidents and Major Aircraft Accidents," in M.R. Endsley and D.J. Garland (Eds)., Situation Awareness Analysis and Measurement, Lawrence Erlbaum Associates, Mahway, NJ, 2000.
19. R. Dhamija, J.D. Tygar, and M. Hearst, "Why Phishing Works," Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI '06), New York, NY, 2006, ACM, pp. 581-590. http://dl.acm.org/citation.cfm?id= 1124861
20. D. Sharek, C. Swofford, and M. Wogalter, "Failure to Recognize Fake Internet Popup Warning Messages," Proceedings of the Human Factors and Ergonomics Society 52nd Annual Meeting, 2008, pp. 557-560.
21. S.G. Hart, and C.D. Wickens, Workload Assessment and Prediction," in H.R. Booher (Ed.), MANPRINT: An Approach to Systems Integration, Van Nostrand Reinhold, New York, 1990, pp. 257-296.
22. National Institute of Standards and Technology (NIST), Risk Management Guide for Information Technology Systems (Special Publication 800-30), U.S. Department of Commerce, 2002.
23. S.B. Sitkin, and L.R. Pablo, "Reconceptualizing the Determinants of Risk Behaviour," Academy of Management Review 17(1), 1992, pp. 9-38.
24. D. Kahneman, and A. Tversky, "Prospect Theory: An Analysis of Decisions Under Risk," Econometrica, 47(2), 1979, pp. 263-291.
25. P.H. Gander, M. van den Berg, and L. Signal, "Sleep and Sleepiness of Fisherman on Rotating Shifts," Chronobiology International, 25(2&3), 2008, pp. 38-398.
26. P.S. Meek, H.W. Clark, and V.L. Solana, "Neurocognitive Impairment: The Unrecognized Component of Dual Diagnosis in Substance Abuse Treatment," Journal of Psychoactive Drugs, Apr-Jun, 21(2), 1989, pp. 153-60.
27. HealthyPeople.gov, Substance Abuse, 2013. http://healthypeople.gov/2020/ LHI/substanceAbuse.aspx
28. A. Park, "Why We Take Risks-It's the Dopamine," time.com, December 30, 2008. http://www.time.com/time/health/article/0,8599,1869106,00. html
29. J.L. Parrish, Jr., J.L. Bailey, and J.F. Courtney, "A Personality Based Model for Determining Susceptibility to Phishing Attacks," Decision Sciences Institute, 2009, pp. 285-296.
30. M.K. Hunt, D.R. Hopko, R. Bare, C.W. Lejuez, and E.V. Robinson, "Construct Validity of the Balloon Analog Risk Task (BART) Associations With Psychopathy and Impulsivity," Assessment, 12(4), 2005, pp. 416-428.
31. M. Jakobsson, and J. Ratkiewicz, "Designing Ethical Phishing Experiments: A Study of (ROT13) Ronl Query Features," Proceedings of the 15th International Conference on World Wide Web, Edinburgh, Scotland, 2006, ACM, 2006, pp. 513-522.
32. W. Knight, "Goin' Phishing?," Infosecurity Today (1:4), 2004, pp. 36-38. http://www.sciencedirect.com/science/article/pii/S1742684704000898
33. J.G. Mohebzada, A. El Zarka, A.H. Bhojani, A. Darwish, "Phishing in a University Community," International Conference on Innovations in Information Technology (IIT), 2012, pp. 249-254.
34. C. Castelfranchi, and R. Falcone, Trust Theory: A Socio-Cognitive and Computational Model (Wiley Series in Agent Technology), John Wiley and Sons, Chichester, UK, 2010.
35. United States Code, Volume 42-The Public Health and Welfare, Section 2000e-16, 1964.
36. United States Code, Title 29 - Labor, Chapter 14 - Age Discrimination in Employment, Sec. 621.
37. A.I.T. Kiser, T. Porter, and D. Vequist, "Employee Monitoring and Ethics: Can They Co-Exist?," International Journal of Digital Literacy and Digital Competence, 1(3), 2010, pp. 30-45.
38. F.L. Greitzer, D.A. Frincke, and M. Zabriskie, "Social/Ethical Issues in Predicitve Insider Threat Monitoring," in M.J. Dark (Ed.), Information Assurance and Security Ethics in Complex Systems: Interdisciplinary Perspectives. Information Science Reference, Hershey, PA, 2010, pp. 132-161.
39. M. Keil, L. Wallace, D. Turk, G. Dixon-Randall, and U. Nulden, "An Investigation of Risk Perception and Risk Propensity on the Decision to Continue a Software Development Project," The Journal of Systems and Software 53(2), 2000, pp. 145-157.
40. C. Gonzalez, J. Dana, H. Koshino, and M. Just, "The Framing Effect and Risky Decisions: Examining Cognitive Functions with fMRI," Journal of Economic Psychology 26(1), 2005, pp. 1-20.
41. E. Klinger, "Modes of Normal Conscious Thought," in K.S. Pope and J.L. Singer (Eds.), The Stream of Consciousness: Scientific Investigations into the Flow of Human Experience, Plenum, New York, 1978, pp. 225-258.
42. C.W. Lejuez, J.P. Read, C.W. Kahler, J.B. Richards, S.E. Ramsey, G.L. Stuart, D.R. Strong, and R.A. Brown, "Evaluation of a Behavioral Measure of Risk Taking: The Balloon Analogue Risk Task (BART)," Journal of Experimental Psychology Applied, 8(2), 2002, pp. 75-84.
43. W.G. Moons, J.R. Spoor, A.E. Kalomiris, and M.K. Rizk, "Certainty Broadcasts Risk Preferences: Verbal and Nonverbal Cues to Risk-Taking," Journal of Nonverbal Behavior, 37(2), 2013, pp. 79-89.
44. Y.R. Tausczik, and J.W. Pennebaker, "The Psychological Meaning of Words: LIWC and Computerized Text Analysis Methods," Journal of Language and Social Psychology 29(1), 2010, pp. 24-54.
45. F.L. Greitzer, L.J. Kangas, C.F. Noonan, A.C. Dalton, and R.E. Hohimer, "Identifying At-Risk Employees: A Behavioral Model for Predicting Potential Insider Threats," 45th Hawaii International Conference on System Sciences (HICSS-45), Wailea, Maui, Hawaii, 2012, pp. 2392-2401.
46. A. Yayla, "Controlling Insider Threats with Information Security Policies (Paper 242)," ECIS 2011 Proceedings, Helsinki, Finland, June 9-11, 2011. http://aisel.aisnet.org/ecis2011/242 (2011).
47. P.M. Milligan, and D. Hutcheson, "Business Risks and Security Assessment for Mobile Devices," Proceedings of the 8th WSEAS Int. Conference on Mathematics and Computers in Business and Economics, Vancouver, Canada, June 19-21, 2007, ACM, 2007, pp. 189-193.