A framework for role-based monitoring of insider misuse

Many security incidents involve legitimate users who misuse their existing privileges, such that they have the system-level right to perform an action, but not the moral right to do so. Current Intrusion Detection Systems (IDSs) are ineffective in this context, because they do not have knowledge of user responsibilities, normal working scope of a user for a relevant position, or the separation of duties that should be enforced. This paper considers examples of the forms that misuse may take within typical applications, and then outlines a novel framework to address the problem of insider misuse monitoring. The approach argues that users with similar roles and responsibilities will exhibit similar behaviour within the system, enabling any activity that deviates from the normal profile to be flagged for further examination. The system utilises established access control principles for defining user roles, and the relationships between them, and proposes a misuse monitoring agent that will police application-level activities for signs of unauthorised behaviour.