The Experts below are selected from a list of 14313 Experts worldwide ranked by ideXlab platform
Carol Hsu - One of the best experts on this subject based on the ideXlab platform.
-
employee intention to whistleblow information security Policy Violation
Pacific Asia Conference on Information Systems, 2014Co-Authors: Liangcheng Wei, Carol HsuAbstract:Insider abuse has always been a significant threat to information security management in organization. In order to address this issue, in this research we propose whistleblowing as another complementary measure to other existent approaches to strengthen the internal information security management. In particular, we focus on an investigation of employee intention to whistle-blow information security Policy (ISP) Violation. Drawing on the theory of planned behavior and rational choice theory, we develop a theoretical model to understand the factors at the organizational and individual levels that might influence whistleblowing attitude and whistleblowing intention. Through a survey-based empirical investigation, we anticipate the results to enhance our existing knowledge on management of insider abuse against information security Policy within organizations.
Liangcheng Wei - One of the best experts on this subject based on the ideXlab platform.
-
employee intention to whistleblow information security Policy Violation
Pacific Asia Conference on Information Systems, 2014Co-Authors: Liangcheng Wei, Carol HsuAbstract:Insider abuse has always been a significant threat to information security management in organization. In order to address this issue, in this research we propose whistleblowing as another complementary measure to other existent approaches to strengthen the internal information security management. In particular, we focus on an investigation of employee intention to whistle-blow information security Policy (ISP) Violation. Drawing on the theory of planned behavior and rational choice theory, we develop a theoretical model to understand the factors at the organizational and individual levels that might influence whistleblowing attitude and whistleblowing intention. Through a survey-based empirical investigation, we anticipate the results to enhance our existing knowledge on management of insider abuse against information security Policy within organizations.
Andrew W Appel - One of the best experts on this subject based on the ideXlab platform.
-
mulval a logic based network security analyzer
USENIX Security Symposium, 2005Co-Authors: Xinming Ou, Sudhakar Govindavajhala, Andrew W AppelAbstract:To determine the security impact software vulnerabilities have on a particular network, one must consider interactions among multiple network elements. For a vulnerability analysis tool to be useful in practice, two features are crucial. First, the model used in the analysis must be able to automatically integrate formal vulnerability specifications from the bug-reporting community. Second, the analysis must be able to scale to networks with thousands of machines. We show how to achieve these two goals by presenting MulVAL, an end-to-end framework and reasoning system that conducts multihost, multistage vulnerability analysis on a network. MulVAL adopts Datalog as the modeling language for the elements in the analysis (bug specification, configuration description, reasoning rules, operating-system permission and privilege model, etc.). We easily leverage existing vulnerability-database and scanning tools by expressing their output in Datalog and feeding it to our MulVAL reasoning engine. Once the information is collected, the analysis can be performed in seconds for networks with thousands of machines. We implemented our framework on the Red Hat Linux platform. Our framework can reason about 84% of the Red Hat bugs reported in OVAL, a formal vulnerability definition language. We tested our tool on a real network with hundreds of users. The tool detected a Policy Violation caused by software vulnerabilities and the system administrators took remediation measures.
Xinming Ou - One of the best experts on this subject based on the ideXlab platform.
-
mulval a logic based network security analyzer
USENIX Security Symposium, 2005Co-Authors: Xinming Ou, Sudhakar Govindavajhala, Andrew W AppelAbstract:To determine the security impact software vulnerabilities have on a particular network, one must consider interactions among multiple network elements. For a vulnerability analysis tool to be useful in practice, two features are crucial. First, the model used in the analysis must be able to automatically integrate formal vulnerability specifications from the bug-reporting community. Second, the analysis must be able to scale to networks with thousands of machines. We show how to achieve these two goals by presenting MulVAL, an end-to-end framework and reasoning system that conducts multihost, multistage vulnerability analysis on a network. MulVAL adopts Datalog as the modeling language for the elements in the analysis (bug specification, configuration description, reasoning rules, operating-system permission and privilege model, etc.). We easily leverage existing vulnerability-database and scanning tools by expressing their output in Datalog and feeding it to our MulVAL reasoning engine. Once the information is collected, the analysis can be performed in seconds for networks with thousands of machines. We implemented our framework on the Red Hat Linux platform. Our framework can reason about 84% of the Red Hat bugs reported in OVAL, a formal vulnerability definition language. We tested our tool on a real network with hundreds of users. The tool detected a Policy Violation caused by software vulnerabilities and the system administrators took remediation measures.
Engin Kirda - One of the best experts on this subject based on the ideXlab platform.
-
beehive large scale log analysis for detecting suspicious activity in enterprise networks
Annual Computer Security Applications Conference, 2013Co-Authors: Tingfang Yen, Alina Oprea, Kaan Onarlioglu, Todd Leetham, William Robertson, Ari Juels, Engin KirdaAbstract:As more and more Internet-based attacks arise, organizations are responding by deploying an assortment of security products that generate situational intelligence in the form of logs. These logs often contain high volumes of interesting and useful information about activities in the network, and are among the first data sources that information security specialists consult when they suspect that an attack has taken place. However, security products often come from a patchwork of vendors, and are inconsistently installed and administered. They generate logs whose formats differ widely and that are often incomplete, mutually contradictory, and very large in volume. Hence, although this collected information is useful, it is often dirty. We present a novel system, Beehive, that attacks the problem of automatically mining and extracting knowledge from the dirty log data produced by a wide variety of security products in a large enterprise. We improve on signature-based approaches to detecting security incidents and instead identify suspicious host behaviors that Beehive reports as potential security incidents. These incidents can then be further analyzed by incident response teams to determine whether a Policy Violation or attack has occurred. We have evaluated Beehive on the log data collected in a large enterprise, EMC, over a period of two weeks. We compare the incidents identified by Beehive against enterprise Security Operations Center reports, antivirus software alerts, and feedback from enterprise security specialists. We show that Beehive is able to identify malicious events and Policy Violations which would otherwise go undetected.