INSIDER THREATS IN A FINANCIAL INSTITUTION: ANALYSIS OF ATTACK-PRONENESS OF INFORMATION SYSTEMS APPLICATIONS

• 成果类型: Article
• 署名作者: Wang, Jingguo; Gupta, Manish; Rao, H. Raghav
• 署名单位: University of Texas System; University of Texas Arlington; State University of New York (SUNY) System; University at Buffalo, SUNY
• 刊物名称: MIS QUARTERLY
• ISSN/ISSBN: 0276-7783
• 发表日期: 2015
• 页码: 91-U491
• 关键词: routine activities; computer abuse; security; crime; RISK; deterrence; ORGANIZATIONS; accessibility; CONVERGENCE; perceptions

摘要

This study investigates the risk of insider threats associated with different applications within a financial institution. Extending routine activity theory (RAT) from criminology literature to information systems security, hypotheses regarding how application characteristics, namely value, inertia, visibility, accessibility, and guardians, cause applications to be exposed to insider threats are developed. Routine activity theory is synthesized with survival modeling, specifically a Weibull hazard model, and users' system access behavior is investigated using seven months of field data from the institution. The inter-arrival times of two successive unauthorized access attempts on an application are employed as the measurement of risk. For a robustness check, the daily number of unauthorized attempts experienced by an application as an alternative measurement of risk are introduced and a zero-inflated Poisson-Gamma model is developed. The Markov chain Monte Carlo (MCMC) method is used for model estimations. The results of the study support the empirical application of routine activity theory in understanding insider threats, and provide a picture of how different applications have different levels of exposure to such threats. Theoretical and practical implications for risk management regarding insider threats are discussed. This study is among the first that uses behavioral logs to investigate victimization risk and attack proneness associated with information assets.