Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations
Insider threat is a persistent concern for organisations and business alike that has attracted the interest of the research community, resulting in numerous behavioural models and tools to tackle it. However, the effectiveness of detection of these tools has scarcely been demonstrated in real enviro...
| Main Authors: | , , , |
|---|---|
| Format: | Journal article |
| Language: | English |
| Published: |
Elsevier
2022
|
| _version_ | 1826307576457854976 |
|---|---|
| author | Erola, A Agrafiotis, I Goldsmith, M Creese, S |
| author_facet | Erola, A Agrafiotis, I Goldsmith, M Creese, S |
| author_sort | Erola, A |
| collection | OXFORD |
| description | Insider threat is a persistent concern for organisations and business alike that has attracted the interest of the research community, resulting in numerous behavioural models and tools to tackle it. However, the effectiveness of detection of these tools has scarcely been demonstrated in real environments. In order to fill this gap, we collaborated with three multinational commercial organisations who trialled our anomaly detection system, and worked with us to understand performance constraints for insider threat detection deployment and innate weaknesses in their operational contexts. During a period longer than a year, we were provided access to real data in their premises and interacted with their cybersecurity analysts to understand their systems, validate the results and identify best practices for mitigating insider threat. In this paper, we provide details on the architecture used in our tool, the methodology followed to validate its performance and we elaborate on our experiences in implementing the tool in the three corporate environments. We present the results obtained from deploying the detection system in real network infrastructure over a period of six months, the lessons learned, issues experienced, and potential limitations.
|
| first_indexed | 2024-03-07T07:05:10Z |
| format | Journal article |
| id | oxford-uuid:b5910f40-d623-4a41-b514-00044e64e767 |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-03-07T07:05:10Z |
| publishDate | 2022 |
| publisher | Elsevier |
| record_format | dspace |
| spelling | oxford-uuid:b5910f40-d623-4a41-b514-00044e64e7672022-04-22T11:56:53ZInsider-threat detection: Lessons from deploying the CITD tool in three multinational organisationsJournal articlehttp://purl.org/coar/resource_type/c_dcae04bcuuid:b5910f40-d623-4a41-b514-00044e64e767EnglishSymplectic ElementsElsevier2022Erola, AAgrafiotis, IGoldsmith, MCreese, SInsider threat is a persistent concern for organisations and business alike that has attracted the interest of the research community, resulting in numerous behavioural models and tools to tackle it. However, the effectiveness of detection of these tools has scarcely been demonstrated in real environments. In order to fill this gap, we collaborated with three multinational commercial organisations who trialled our anomaly detection system, and worked with us to understand performance constraints for insider threat detection deployment and innate weaknesses in their operational contexts. During a period longer than a year, we were provided access to real data in their premises and interacted with their cybersecurity analysts to understand their systems, validate the results and identify best practices for mitigating insider threat. In this paper, we provide details on the architecture used in our tool, the methodology followed to validate its performance and we elaborate on our experiences in implementing the tool in the three corporate environments. We present the results obtained from deploying the detection system in real network infrastructure over a period of six months, the lessons learned, issues experienced, and potential limitations. |
| spellingShingle | Erola, A Agrafiotis, I Goldsmith, M Creese, S Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title | Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title_full | Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title_fullStr | Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title_full_unstemmed | Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title_short | Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations |
| title_sort | insider threat detection lessons from deploying the citd tool in three multinational organisations |
| work_keys_str_mv | AT erolaa insiderthreatdetectionlessonsfromdeployingthecitdtoolinthreemultinationalorganisations AT agrafiotisi insiderthreatdetectionlessonsfromdeployingthecitdtoolinthreemultinationalorganisations AT goldsmithm insiderthreatdetectionlessonsfromdeployingthecitdtoolinthreemultinationalorganisations AT creeses insiderthreatdetectionlessonsfromdeployingthecitdtoolinthreemultinationalorganisations |