The Insider Threat

The Insider threat is defined similarly by experts in the information technology world for businesses, but addressing the threat has not been of great focus for most organizations. Technology and the Internet have grown exponentially over the past decade leading to changes in how business is conducted. Some basic business practices remain the same; protect the organization and its customers from breach of privacy. How data is gathered, stored, and retrieved has changed. Protecting the perimeter is still important, but these changes in technology now open the doors to a new threat; one that is known but not commonly protected against; the insider. Whether intentionally, or accidentally, the insider threat needs to be incorporated into the currently used security architectures and best practices. How should an organization include the insider threat to the current architecture is the question. Changes need to be made by organizations to the current security architecture. Currently, using technology is not enough, but is still necessary. In order to make it better, considering the employee as a whole and the daily activities necessary to complete a job, as well as working with other business units as a whole needs to be included in the architecture. Behavioral traits can be considered but there are issues in privacy that also need to be considered. Monitoring can be done, but that should not be the only thing considered. Employees lack knowledge as to why actions can have a negative effect on an organization and the way to address this is education. Educating end users is necessary and should be performed regularly to keep not just the technologically inclined up to date. Without education, the current technology used will continue to keep out the intruders, but will not be effective enough to protect against intentional and accidental misuse of the organization and its networks

Gaming security by obscurity

Shannon sought security against the attacker with unlimited computational powers: *if an information source conveys some information, then Shannon's attacker will surely extract that information*. Diffie and Hellman refined Shannon's attacker model by taking into account the fact that the real attackers are computationally limited. This idea became one of the greatest new paradigms in computer science, and led to modern cryptography. Shannon also sought security against the attacker with unlimited logical and observational powers, expressed through the maxim that "the enemy knows the system". This view is still endorsed in cryptography. The popular formulation, going back to Kerckhoffs, is that "there is no security by obscurity", meaning that the algorithms cannot be kept obscured from the attacker, and that security should only rely upon the secret keys. In fact, modern cryptography goes even further than Shannon or Kerckhoffs in tacitly assuming that *if there is an algorithm that can break the system, then the attacker will surely find that algorithm*. The attacker is not viewed as an omnipotent computer any more, but he is still construed as an omnipotent programmer. So the Diffie-Hellman step from unlimited to limited computational powers has not been extended into a step from unlimited to limited logical or programming powers. Is the assumption that all feasible algorithms will eventually be discovered and implemented really different from the assumption that everything that is computable will eventually be computed? The present paper explores some ways to refine the current models of the attacker, and of the defender, by taking into account their limited logical and programming powers. If the adaptive attacker actively queries the system to seek out its vulnerabilities, can the system gain some security by actively learning attacker's methods, and adapting to them?Comment: 15 pages, 9 figures, 2 tables; final version appeared in the Proceedings of New Security Paradigms Workshop 2011 (ACM 2011); typos correcte

AICPA Technical Practice Aids, as of June 1, 2005, Volume 2

https://egrove.olemiss.edu/aicpa_guides/2584/thumbnail.jp

Local Amenity Societies - Participation and Power: A case study on the St Marylebone Society 1948 - 2021

This research evidences the power and influence local amenity societies have had on planning policy, conservation and townscape since World War II. It is based on a single case study of the St Marylebone Society (SMS), an amenity society founded in 1948 to protect the townscape of Marylebone in central London. It describes how they established, increased membership and linked with organisations to increase their network power, evolving and adapting to operate effectively within changing planning policy frameworks over the ensuing decades to the present day. Their involvement at four sites in Marylebone, considered at different time periods, assesses the outcomes to evidence their acquisition and use of both overt and covert power, as identified by Lukes (2005). The strategies and tactics they employed to exercise their power are considered in detailed historical narratives, with reference to Flyvjberg’s (1998) theories relating to power, rationality, rationalization and how long-standing personal relationships are instrumental to decision-making at local level. Today amenity societies are embedded within the planning system and integral to political ambition to increase public participation and engender social capital, as legislated by Neighbourhood Planning. However, they are essentially self-elected volunteers, dominated by a homogenous demographic, raising issues of equity and representation in an increasingly complex, culturally diverse and politically divided society. The benefits of their long-term activism and knowledge risk being lost by declining membership and broken networks. This research identifies that amenity societies must protect their valuable cumulative phronetic knowledge, adapt to embrace technology and policies to encourage wider participation and optimise their network power for positive townscape, neighbourhood and community outcomes