Adaptive Security Policy Using User Behavior Analysis and Human Elements of Information Security
Ines Brosso, Alessandro La · InTech eBooks · 2012
IntroductionAt present, security policy, to be effective, is primarily focused on people, being very rigid at this, and only later it cares about security attack attempts.The security policy does not need to be rigid: rather it should be adaptable to the user behavior.Analysis of human behavior, therefore, is the basis for an adaptive security policy.The behavior analysis of a person can be verified by a set of rules, which consider the variables that can influence human behavior, based on the information acquired about the environment, space, time, equipment, hardware and software.This information is used to analyze behavioral evidences about people, and establishes if it is possible to believe or not in the user.Therefore, according to the user behavior, levels of trust are released, which are based on the rules that were previously established for the parameters that are necessary to establish the evidences of behavioral trust, in its different degrees.The adaptive security policy based on user behavior analysis is the basis for the information security management, when it comes to understanding the needs of users.However, to achieve the whole security target in computing, and related technologies, it is necessary not only to have the most updated core technologies or security policies, but also to have the capacity to perform the analyses of the user behavior and the security environment.This work, in the context of computer security, uses the operant and conditioning behavior defined by Skinner (1991), which rewards a response of an individual until he is conditioned to associate the need for action.The Skinner Theory may be very interesting to be used in Information Security Management Systems.In operant behavior, the environment is modified and produces consequences that are working on it again, changing the likelihood of a future similar occurrence.Operant conditioning is a mechanism for learning a new behavior.