Enhancing directory virtualization to detect insider activity

William Claycomb, Dongwan Shin, Gail-Joon Ahn

Research output: Contribution to journalArticle

3 Scopus citations

Abstract

One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system-based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results.

Original languageEnglish (US)
Pages (from-to)873-886
Number of pages14
JournalSecurity and Communication Networks
Volume5
Issue number8
DOIs
StatePublished - Aug 2012

Keywords

  • Insider threat
  • Security
  • Virtual directories

ASJC Scopus subject areas

  • Information Systems
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Enhancing directory virtualization to detect insider activity'. Together they form a unique fingerprint.

  • Cite this