Show simple item record

dc.contributor.advisorAbel Sanchez and Donna H. Rhodes.en_US
dc.contributor.authorEssilfie-Conduah, Nana,S.M.Massachusetts Institute of Technology.en_US
dc.contributor.otherMassachusetts Institute of Technology. Engineering and Management Program.en_US
dc.contributor.otherSystem Design and Management Program.en_US
dc.date.accessioned2019-10-04T21:34:46Z
dc.date.available2019-10-04T21:34:46Z
dc.date.copyright2019en_US
dc.date.issued2019en_US
dc.identifier.urihttps://hdl.handle.net/1721.1/122440
dc.descriptionThesis: S.M. in Engineering and Management, Massachusetts Institute of Technology, System Design and Management Program, 2019en_US
dc.descriptionCataloged from PDF version of thesis.en_US
dc.descriptionIncludes bibliographical references (pages 105-110).en_US
dc.description.abstractIt has become common place to hear of data breaches. Typically, we hear of external hackers as the perpetrators, however, the reality is there is a high frequency of threats from insiders within an organization and that the cost and challenge in detecting these threats is considerable. The issue has affected companies in multiple private sectors (finance, retail) and the public sector is also at risk as apparent with the Edward Snowden and Chelsea Manning cases. This thesis explores the current space of insider threats in terms of frequency, cost and complexity in attack assessment. It also explores the multiple perspectives and stakeholders that make up the complex insider threat systems. Insights from multiple insider threat cases as well as subject matter experts in cyber security were used to model and pinpoint the high value metrics around access management and logging that will aid audit efforts. Following this an exploration of kill chains, blockchain technology and hierarchical organization exploration is made. Research findings highlight the wide reach of excessive privileges and the crucial role resource access and event logging of stakeholder actions plays in the success of insider threat prevention. In response to this finding a proposal is made for a combined solution that aims to provide an easy and accessible interface for searching and requesting access to resources that scales with an organization. This proposal suggests the capitalization of the transparent and immutable properties of blockchain to ledger the requesting and approval of file access through dynamic and multi user approval logic. The solution combines simplistic file-based resource access in an accessible manner with a multi layered security approach that adds further hurdles for bad actors but provides a visible and reliable look back on an immutable audit path.en_US
dc.description.statementofresponsibilityby Nana Essilfie-Conduah.en_US
dc.format.extent110 pagesen_US
dc.language.isoengen_US
dc.publisherMassachusetts Institute of Technologyen_US
dc.rightsMIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.en_US
dc.rights.urihttp://dspace.mit.edu/handle/1721.1/7582en_US
dc.subjectEngineering and Management Program.en_US
dc.subjectSystem Design and Management Program.en_US
dc.titleA systems analysis of insider data exfiltration : a decentralized framework for disincentivizing and auditing data exfiltrationen_US
dc.typeThesisen_US
dc.description.degreeS.M. in Engineering and Managementen_US
dc.contributor.departmentMassachusetts Institute of Technology. Engineering and Management Programen_US
dc.identifier.oclc1120725555en_US
dc.description.collectionS.M.inEngineeringandManagement Massachusetts Institute of Technology, System Design and Management Programen_US
dspace.imported2019-10-04T21:34:44Zen_US
mit.thesis.degreeMasteren_US
mit.thesis.departmentSysDesen_US


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record