Development of a Methodology for Customizing Insider Threat Auditing on a Linux Operating System

William T. Bai

ISBN 10: 1249449847 / ISBN 13: 9781249449843

Published by Bibliolife Sep 2012, 2012

About this Item

Neuware - Insider threats can pose a great risk to organizations and by their very nature are difficult to protect against. Auditing and system logging are capabilities present in most operating systems and can be used for detecting insider activity. However, current auditing methods are typically applied in a haphazard way, if at all, and are not conducive to contributing to an effective insider threat security policy. This research develops a methodology for designing a customized auditing and logging template for a Linux operating system. An intent-based insider threat risk assessment methodology is presented to create use case scenarios tailored to address an organization's specific security needs and priorities. These organization specific use cases are verified to be detectable via the Linux auditing and logging subsystems and the results are analyzed to create an effective auditing rule set and logging configuration for the detectable use cases. Results indicate that creating a customized auditing rule set and system logging configuration to detect insider threat activity is possible.

Seller Inventory # 9781249449843

Bibliographic Details

• Title: Development of a Methodology for Customizing Insider Threat Auditing on a Linux Operating System
• Publisher: Bibliolife Sep 2012
• Publication Date: 2012
• Language: English
• ISBN 10: 1249449847
• ISBN 13: 9781249449843
• Binding: Taschenbuch
• Condition: Neu
• Dimensions: 249W x 189H x 12D millimeters 249 millimeters width by 189 millimeters height by 12 millimeters depth
• Weight: 240 grams

About this title

Synopsis

Insider threats can pose a great risk to organizations and by their very nature are difficult to protect against. Auditing and system logging are capabilities present in most operating systems and can be used for detecting insider activity. However, current auditing methods are typically applied in a haphazard way, if at all, and are not conducive to contributing to an effective insider threat security policy. This research develops a methodology for designing a customized auditing and logging template for a Linux operating system. An intent-based insider threat risk assessment methodology is presented to create use case scenarios tailored to address an organization's specific security needs and priorities. These organization specific use cases are verified to be detectable via the Linux auditing and logging subsystems and the results are analyzed to create an effective auditing rule set and logging configuration for the detectable use cases. Results indicate that creating a customized auditing rule set and system logging configuration to detect insider threat activity is possible.