Enhancing directory virtualization to detect insider activity

William Claycomb, Dongwan Shin, Gail-Joon Ahn

Research output: Contribution to journalArticle

3 Citations (Scopus)

Abstract

One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system-based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results.

Original languageEnglish (US)
Pages (from-to)873-886
Number of pages14
JournalSecurity and Communication Networks
Volume5
Issue number8
DOIs
StatePublished - Aug 2012

Fingerprint

Security of data
Access control
Authentication
Engines
Monitoring
Industry
Virtualization

Keywords

  • Insider threat
  • Security
  • Virtual directories

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Information Systems

Cite this

Enhancing directory virtualization to detect insider activity. / Claycomb, William; Shin, Dongwan; Ahn, Gail-Joon.

In: Security and Communication Networks, Vol. 5, No. 8, 08.2012, p. 873-886.

Research output: Contribution to journalArticle

Claycomb, William ; Shin, Dongwan ; Ahn, Gail-Joon. / Enhancing directory virtualization to detect insider activity. In: Security and Communication Networks. 2012 ; Vol. 5, No. 8. pp. 873-886.
@article{022509fc325f489399256f0bfb4d3a8f,
title = "Enhancing directory virtualization to detect insider activity",
abstract = "One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system-based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results.",
keywords = "Insider threat, Security, Virtual directories",
author = "William Claycomb and Dongwan Shin and Gail-Joon Ahn",
year = "2012",
month = "8",
doi = "10.1002/sec.362",
language = "English (US)",
volume = "5",
pages = "873--886",
journal = "Security and Communication Networks",
issn = "1939-0122",
publisher = "John Wiley and Sons Inc.",
number = "8",

}

TY - JOUR

T1 - Enhancing directory virtualization to detect insider activity

AU - Claycomb, William

AU - Shin, Dongwan

AU - Ahn, Gail-Joon

PY - 2012/8

Y1 - 2012/8

N2 - One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system-based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results.

AB - One of the critical yet lingering issues in computer security is insider threat, and it often takes advantage of some security services based on directory services such as authentication and access control. Detecting these threats is quite challenging because malicious users with the technical ability to leverage these services often have sufficient knowledge and expertise to conceal unauthorized activity. In this article, we present an approach using directory virtualization to monitor various systems across an enterprise for the purpose of detecting malicious insider activity. Specifically, a policy engine that leverages directory virtualization services is proposed to enhance monitoring and detecting capabilities by allowing greater flexibility in analyzing changes for malicious intent. The resulting architecture is a system-based approach, where the relationships and dependencies between data sources and directory services are used to detect an insider threat, rather than simply relying on point solutions. This paper presents such an architecture in detail, including a description of implementation results.

KW - Insider threat

KW - Security

KW - Virtual directories

UR - http://www.scopus.com/inward/record.url?scp=84864325718&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84864325718&partnerID=8YFLogxK

U2 - 10.1002/sec.362

DO - 10.1002/sec.362

M3 - Article

AN - SCOPUS:84864325718

VL - 5

SP - 873

EP - 886

JO - Security and Communication Networks

JF - Security and Communication Networks

SN - 1939-0122

IS - 8

ER -