Insider Computer Fraud: An In-depth Framework for Detecting and Defending against Insider IT Attacks

506 Pages·2007·4.94 MB·English

by  Kenneth Brancik

I N S I D E R
C O M P U T E R
F R A U D
AN IN-DEPTH FRAMEWORK
FOR DETECTING AND DEFENDING
AGAINST INSIDER IT ATTACKS
AU4659.indb 1 11/1/07 12:01:03 PM
AU4659.indb 2 11/1/07 12:01:03 PM
I N S I D E R
C O M P U T E R
F R A U D
AN IN-DEPTH FRAMEWORK
FOR DETECTING AND DEFENDING
AGAINST INSIDER IT ATTACKS
Kenneth C. Brancik
Boca Raton New York
Auerbach Publications is an imprint of the
Taylor & Francis Group, an informa business
AU4659.indb 3 11/1/07 12:01:03 PM
The fundamental research and writing of this book preceded my employment at VerizonBusiness.
The opinions, analysis, and writings are my own and were based on my computer science research
as a former Doctoral student at Pace University, New York.
Auerbach Publications
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2008 by Taylor & Francis Group, LLC
Auerbach is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed in the United States of America on acid-free paper
10 9 8 7 6 5 4 3 2 1
International Standard Book Number-13: 978-1-4200-4659-5 (Hardcover)
This book contains information obtained from authentic and highly regarded sources. Reprinted
material is quoted with permission, and sources are indicated. A wide variety of references are
listed. Reasonable efforts have been made to publish reliable data and information, but the author
and the publisher cannot assume responsibility for the validity of all materials or for the conse-
quences of their use.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information
storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.
copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC)
222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that
provides licenses and registration for a variety of users. For organizations that have been granted a
photocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and
are used only for identification and explanation without intent to infringe.
Library of Congress Cataloging-in-Publication Data
Brancik, Kenneth C.
Insider computer fraud : an in-depth framework for detecting and defending
against insider IT attacks / Kenneth Brancik.
p. cm.
Includes bibliographical references and index.
ISBN 978-1-4200-4659-5 (alk. paper)
1. Computer security . 2. Computer crimes. I. Title.
QA76.9.A25B725 2007
005.8--dc22 2007017696
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the Auerbach Web site at
http://www.auerbach-publications.com
AT&UF4_6L5O9.Cin_dAb_ M 4aster.indd 1 1101//311/0/077 1 22::5021::0043 PPMM
Dedication
This book is dedicated to my Mother, who took care of four young adults; when
my Father passed away early in my life, she was suddenly forced to reenter the job
market, while still providing her family the care and support we all needed during
our growing years through adulthood. I owe my strong work ethic and dedication
to my personal goals to her and the good example she has demonstrated over many
years as a supportive parent.
AU4659.indb 5 11/1/07 12:01:04 PM
AU4659.indb 6 11/1/07 12:01:04 PM
Contents
Preface .........................................................................................................xvii
Key Features .................................................................................................xix
Organization of the Book .........................................................................xxiii
About the Author .......................................................................................xxxi
Acknowledgments ...................................................................................xxxiii
Chapter 1 Insider Computer Fraud (ICF)..............................................1
1.1 Introduction .....................................................................................1
1.2 The Primary Accomplishments of This Book ....................................1
1.3 An Overview of Insider Computer Fraud .........................................3
1.3.1 Insider Defined ...................................................................3
1.3.2 Fundamental Elements of Computer Fraud ........................4
1.4 Insider Threat Concepts and Concerns .............................................4
1.5 Defense in Depth .............................................................................6
1.6 Conclusion .......................................................................................8
Reference .....................................................................................................8
Chapter 2 Related Research in Insider Computer Fraud and

Information Security Controls .............................................9
2.1 Introduction .....................................................................................9
2.2 Insider Threat Study: Illicit Cyber Activity in the Banking
and Finance Sector .........................................................................11
2.3 A Framework for Understanding and Predicting Insider
Attacks ...........................................................................................12
2.4 Methodology for the Optimization of Resources in the
Detection of Computer Fraud ........................................................14
2.5 Managing the Insider Threat ..........................................................18
2.5.1 Authentication ..................................................................18
2.5.2 Privileges ..........................................................................18
vii
AU4659.indb 7 11/1/07 12:01:04 PM
viii ◾ Contents
2.5.3 Physical Security Issues .....................................................19
2.5.4 Warning Signs ..................................................................20
2.5.5 HTTP Tunneling .............................................................20
2.6 Conclusion .....................................................................................21
Additional Resources .................................................................................22
References ..................................................................................................26
Chapter 3 The Insider Threat Strategic Planning Process ...................27

3.1 Introduction ...................................................................................27
3.2 Security Objectives .........................................................................28
3.3 Understanding the Information Security Governance Process ........30
3.4 Cyber-Security Risk Governance Processes for Web-Based
Application Protection (Understanding the External Risks
and Internal Information Security Risks) .......................................30
3.5 The Risk Management Process (Risk 101—Concepts) ...................32
3.5.1 What Should Be Included in the Risk Management
Process? .............................................................................33
3.5.2 The Tailored Risk Integrated Process (TRIP) ...................33
3.5.2.1 Broad-Brush Approach (Macro Approach) ......34
3.5.2.2 The Recommended Integrated Business/
Technology Approach (Application
to Infrastructure) ..............................................35
3.5.2.3 The TRIP Strategy ............................................36
3.6 Security Controls in Application Systems Controls (ISO
27001) ............................................................................................37
3.6.1 Security in Application Systems Controls Needs to Be
Clearly Articulated within an InfoSec Policy ....................37
3.7 Security and SOX 404 Designated Applications and Systems ........41
3.8 Application Risk Weightings for Criticality Factors Report ............41
3.9 The Inherent Risk Valuation Report ...............................................41
3.10 An Example of Various Web Application Threats ...........................43
3.11 An Example of a Risk Ranking of Critical Production
Applications ..................................................................................46
3.12 The Risk Assessment HeatMap .....................................................46
3.13 The Risk Assessment (Acceptance) Process .....................................48
3.14 Net Residual Risk (NRR) ..............................................................52
3.14.1 Probability of Occurrence .................................................52
3.14.2 Business Impact Assessment (BIA) ...................................53
3.14.3 Business Continuity Planning ..........................................53
3.15 Application-Based Controls: The 2005 Global Technology
Audit Guide (GTAG), The Institute of Internal Auditors (IIA) ......54
3.15.1 Application Controls ........................................................54
3.15.1.1 BS ISO/IEC 27001:2005 ..................................54
AU4659.indb 8 11/1/07 12:01:04 PM
Contents ◾ ix
3.16 Laws, Rules, and Regulations .........................................................57
3.16.1 H.R. 4127 (Data Accountability and Trust Act
[DATA]) October 25, 2005 ..............................................58
3.16.2 Notification of Information Security Breach .....................58
3.17 Critical Path of NPPI and Core Business Transactions ...................60
3.17.1 NPPI Data ........................................................................60
3.18 Information Security Theory and Control Point Identification .......60
3.19 Control Points and the Key Risk Indicator (KRI) ..........................61
3.20 The Relationship between KRIs, Control Points, and IT
Infrastructure .................................................................................61
3.21 The Relationship between the Risk Evaluation Process and the
Defense in Depth (DiD) Efficiency Calculation .............................62
3.22 Background on the Origin of Bayes’ Theorem and Practical
InfoSec Application of the Theorem Using the DiD Efficiency
Calculation .....................................................................................62
3.23 Determining an Applications Residual Risk (Inherent Risk-
Mitigating Controls) ......................................................................63
3.24 Determining an Application’s Net Residual Risk (Inherent
Risk-Mitigating Controls ± IT Infrastructure and Software
Controls (Optimizers) ...................................................................64
3.25 A Quantitative Analysis (Defense in Depth Efficiency
Calculation)...................................................................................64
3.25.1 Step 1: Complete the Application Control Point
Ratings Matrix ................................................................64
3.25.2 Step 2: Complete the IT Infrastructure and Software
Control Point Rating Matrix Operating System
(Application Security Optimizer)......................................65
3.25.2.1 Network Perimeter (Application Security
Optimizer) ........................................................68
3.25.3 Step 3: Calculate the DiD Security Effectiveness
Percentage Using All Five Layers of Protection and
with Two Out of the Five Layers of Protection .................71
3.25.3.1 Scenario 1: Calculating the Defense in Depth
Security Efficiency Ratio with Five Layers ............73
3.25.3.2 Scenario 2: Calculating the Defense in
Depth Security Efficiency Ratio with Only
Two Layers of Defense ......................................74
3.25.4 Step 4: Assign a Qualitative Rating to the Total
Defense in Depth Security Efficiency Percentage ..............76
3.25.5 Step 5: Perform an Update on the Threat Modeling
Rating Based on the Results of the Defense in Depth
Calculation and the Net Residual Risk Rating Assessment .76
3.26 The Threat Assessment Process (The Integration Process) ..............77
AU4659.indb 9 11/1/07 12:01:04 PM