The Danger Within: Insider Threat Modeling Using Business Process Models
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866929483113562112 |
|---|---|
| author | von der Assen, Jan Hochuli, Jasmin Grübl, Thomas Stiller, Burkhard |
| author_facet | von der Assen, Jan Hochuli, Jasmin Grübl, Thomas Stiller, Burkhard |
| contents | Threat modeling has been successfully applied to model technical threats within information systems. However, a lack of methods focusing on non-technical assets and their representation can be observed in theory and practice. Following the voices of industry practitioners, this paper explored how to model insider threats based on business process models. Hence, this study developed a novel insider threat knowledge base and a threat modeling application that leverages Business Process Modeling and Notation (BPMN). Finally, to understand how well the theoretic knowledge and its prototype translate into practice, the study conducted a real-world case study of an IT provider's business process and an experimental deployment for a real voting process. The results indicate that even without annotation, BPMN diagrams can be leveraged to automatically identify insider threats in an organization. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2406_01135 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | The Danger Within: Insider Threat Modeling Using Business Process Models von der Assen, Jan Hochuli, Jasmin Grübl, Thomas Stiller, Burkhard Cryptography and Security Threat modeling has been successfully applied to model technical threats within information systems. However, a lack of methods focusing on non-technical assets and their representation can be observed in theory and practice. Following the voices of industry practitioners, this paper explored how to model insider threats based on business process models. Hence, this study developed a novel insider threat knowledge base and a threat modeling application that leverages Business Process Modeling and Notation (BPMN). Finally, to understand how well the theoretic knowledge and its prototype translate into practice, the study conducted a real-world case study of an IT provider's business process and an experimental deployment for a real voting process. The results indicate that even without annotation, BPMN diagrams can be leveraged to automatically identify insider threats in an organization. |
| title | The Danger Within: Insider Threat Modeling Using Business Process Models |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2406.01135 |