Show simple item record

dc.contributor.advisorValacich, Joseph S.en_US
dc.contributor.advisorNunamaker, Jay F., Jr.en_US
dc.contributor.authorJenkins, Jeffrey Lyne
dc.creatorJenkins, Jeffrey Lyneen_US
dc.date.accessioned2013-07-24T20:54:26Z
dc.date.available2013-07-24T20:54:26Z
dc.date.issued2013
dc.identifier.urihttp://hdl.handle.net/10150/297023
dc.description.abstractInsider threats--trusted members of an organization who compromise security--are considered the greatest security threat to organizations. Because of ignorance, negligence, or malicious intent, insider threats may cause security breaches resulting in substantial damages to organizations and even society. This research helps alleviate the insider threat through developing mitigation strategies and detection techniques in three studies. Study 1 examines how security controls--specifically depth-of-authentication and training recency--alleviate non-malicious insider threats through encouraging secure behavior (i.e., compliance with an organization's security policy). I found that `simpler is better' when implementing security controls, the effects of training diminish rapidly, and intentions are poor predictors of actual secure behavior. Extending Study 1's finding on training recency, Study 2 explains how different types of training alleviate non-malicious insider threat activities. I found that just-in-time reminders are more effective than traditional training programs in improving secure behavior, and again that intentions are not an adequate predictor of actual secure behavior. Both Study 1 and Study 2 introduce effective mitigation strategies for alleviating the non-malicious insider threat; however, they have limited utility when an insider threat has malicious intention, or deliberate intentions to damage the organization. To address this limitation, Study 3 conducts research to develop a tool for detecting malicious insider threats. The tool monitors mouse movements during an insider threat screening survey to detect when respondents are being deceptive. I found that mouse movements are diagnostic of deception. Future research directions are discussed to integrate and extend the findings presented in this dissertation to develop a behavioral information security framework for alleviating both the non-malicious and malicious insider threats in organizations.
dc.language.isoenen_US
dc.publisherThe University of Arizona.en_US
dc.rightsCopyright © is held by the author. Digital access to this material is made possible by the University Libraries, University of Arizona. Further transmission, reproduction or presentation (such as public display or performance) of protected items is prohibited except with permission of the author.en_US
dc.subjectInformation Systemsen_US
dc.subjectInsider Threaten_US
dc.subjectMouse Movementsen_US
dc.subjectPasswordsen_US
dc.subjectSecurityen_US
dc.subjectManagementen_US
dc.subjectExperimenten_US
dc.titleAlleviating Insider Threats: Mitigation Strategies and Detection Techniquesen_US
dc.typetexten_US
dc.typeElectronic Dissertationen_US
thesis.degree.grantorUniversity of Arizonaen_US
thesis.degree.leveldoctoralen_US
dc.contributor.committeememberDurcikova, Alexandraen_US
dc.contributor.committeememberHairiri, Salimen_US
dc.contributor.committeememberNunamaker, Jay F., Jr.en_US
dc.contributor.committeememberValacich, Joseph S.en_US
thesis.degree.disciplineGraduate Collegeen_US
thesis.degree.disciplineManagementen_US
thesis.degree.namePh.D.en_US
refterms.dateFOA2018-06-30T17:01:06Z
html.description.abstractInsider threats--trusted members of an organization who compromise security--are considered the greatest security threat to organizations. Because of ignorance, negligence, or malicious intent, insider threats may cause security breaches resulting in substantial damages to organizations and even society. This research helps alleviate the insider threat through developing mitigation strategies and detection techniques in three studies. Study 1 examines how security controls--specifically depth-of-authentication and training recency--alleviate non-malicious insider threats through encouraging secure behavior (i.e., compliance with an organization's security policy). I found that `simpler is better' when implementing security controls, the effects of training diminish rapidly, and intentions are poor predictors of actual secure behavior. Extending Study 1's finding on training recency, Study 2 explains how different types of training alleviate non-malicious insider threat activities. I found that just-in-time reminders are more effective than traditional training programs in improving secure behavior, and again that intentions are not an adequate predictor of actual secure behavior. Both Study 1 and Study 2 introduce effective mitigation strategies for alleviating the non-malicious insider threat; however, they have limited utility when an insider threat has malicious intention, or deliberate intentions to damage the organization. To address this limitation, Study 3 conducts research to develop a tool for detecting malicious insider threats. The tool monitors mouse movements during an insider threat screening survey to detect when respondents are being deceptive. I found that mouse movements are diagnostic of deception. Future research directions are discussed to integrate and extend the findings presented in this dissertation to develop a behavioral information security framework for alleviating both the non-malicious and malicious insider threats in organizations.


Files in this item

Thumbnail
Name:
azu_etd_12808_sip1_m.pdf
Size:
2.317Mb
Format:
PDF

This item appears in the following Collection(s)

Show simple item record