An Enhanced Threat Identification Approach for Collusion Threats
Harpreet Kohli, Dale Lindskog, Pavol Zavarsky, Ron Ruhl · 2011
Colluding threat agents are a serious and difficult problem to deal with in any organization. Collusion is possible at any level and with any entity inside or outside the organization. Traditional methods cannot effectively deal with legitimate users who abuse their privileges and their familiarity and proximity to the computational environment by colluding with outsiders or other insiders to exploit the organization's critical assets. In this paper, we emphasize the limitation of current approaches to threat identification and, because of the seriousness of collusion involving insider threat agents, we give special attention to the MERIT (Management and Education of the Risk of Insider Threat) model. In response to these limitations, we propose an enhanced approach to threat identification, an approach that explicitly and formally addresses the possibility of colluding threat agents.