Exploiting the dark triad for national defense capabilities. Dimitris Gritzalis

Transcription

1 Exploiting the dark triad for national defense capabilities Dimitris Gritzalis May 2015

2 Exploiting the dark triad for national defense capabilities Professor Dimitris A. Gritzalis Information Security & Critical Infrastructure Protection (INFOSEC) Laboratory Dept. of Informatics, Athens University of Economics & Business

3 What is all about? The problem: An insider as a severe threat to na.onal defense The theory: Narcissists tend to turn insiders The defense: Reveal narcissists The data source: Online Social Networks and the Web 2.0 The tool: NEREUS Framework

4 The problem: The Insider threat Insider threat was the top priority to protect for 2014 Insiders are persons who: - are legi.mately given access rights to a Cri.cal Infrastructure - misuse their privileges and violate security policy Insiders consist the top source of data breaches Source: CERT, Cyber Security Watch Survey: How Bad Is the Threat?, Carnegie Mellon University, USA, 2014.

5 The theory: The Dark Triad Dark Triad personality traits Ø Narcissism: Inflated self- view and focus on themselves Ø Machiavellianism: Manipula.ve personality Ø Psychopathy: High impulsivity and thrill- seeking, along with low empathy and low anxiety Dark Triad traits are used to extend Five Factor Model (FFM) to represent socially malevolent behavior The wealth of data provided by OSN users has opened the door to a new way of analyzing personality Ability to exploit narcissism personality trait Ø Narcissism trait is also examined by Shaw and the FBI Sources: M. Maasberg, J. Warren, N. Beebe, The Dark Side of the Insider: Detec.ng the Insider Threat through examina.on of Dark Triad personality traits. Federal Bureau of Inves.ga.on, The insider threat: An introduc=on to detec=ng and deterring an insider spy, USA, E. Shaw, K. Ruby, J. Post, The insider threat to informa.on systems: The psychology of the dangerous insider, Security Awareness Bulle=n, vol. 2, no. 98, pp

6 The defense: Open Source Intelligence Open Source Intelligence (OSINT) is produced from publicly available informa.on, which is: Ø Collected, exploited and disseminated in a Amely manner Ø Offered to an appropriate audience Ø Used for the purpose of addressing a specific intelligence requirement Publicly available informa.on refers to (not only): Ø Tradi.onal media (e.g. television, newspapers, radio, magazines, etc.) Ø Web- based communi.es (e.g. social networking sites, blogs, etc.) Ø Public data (e.g. government reports, official data, public hearings, etc.) Ø Amateur observa.on/repor.ng (e.g. amateur spoaers, radio monitors, etc.) OSINT defined by US Dept. of Defense (Public Law , Sec. 931,Na.onal Defense Authoriza.on Act for Fiscal Year 2006). SOCMINT is produced from Online Social Networks & the Web 2.0

7 The data source: Web 2.0 & Online Social Networks Source: hap://socialmediatoday.com/

8 The tool: The NEREUS Framework NEREUS Framework OSN: TwiPer Tools used for the open data analysis Science Informa.cs Sociology Psychology Theory Graph Theory Content Analysis Theory of Planned Behavior Social Learning Theory ApplicaAon: Insider threat detec.on/predic.on, influen.al users detec.on, means of communica.on evalua.on, etc.

9 The NEREUS Framework in a nutshell

10 The dataset ualized Focus on a Greek TwiPer community: Ø Context sensi.ve research Ø U.lize ethnological features rooted in locality Ø Extract and analyze results Analysis of content and measures of user influence and usage intensity User Categories: Follower, Following, Retweeter Graph: Ø Each user is a node Ø Every interac.on is a directed edge fully crawled users (personal & sta.s.cal data) Ø Name, ID, personal descrip.on, URL, language, geoloca.on, profile state, lists, # of following/followers, tweets, # of favorites, # of men.ons, # of retweets TwiPer (Greece, ) connec.ons among them

11 Graph theoreacal and content analysis Strongly connected components: Ø There exists 1 large component ( nodes connected to each other) and several smaller ones Node Loneliness: Ø 99% of users connected to someone Small World phenomenon: Ø Every user lies <6 hops away from anyone else Indegree DistribuAon: Ø # of users following each user Ø Average 13.2 followers/user Outdegree DistribuAon: Ø # of users each user follows Ø Average 11 followers/user Usage Intensity DistribuAon: Weighted aggrega.on of: {# of followers, # of followings, tweets, retweets, men.ons, favorites, lists} Important cluster of users

12 Conclusions ü Web 2.0 produces vast amounts of crawlable informa.on and OSINT can transform it into intelligence. ü OSINT can assist in detec.ng the Dark Triad traits (narcissis.c behavior, etc.). ü OSINT can help in predic.ng insiders, in predic.ng delinquent behavior, and in enhancing na.onal defense. ü OSINT intrusive nature dictates use for specific purposes, according to law.

13 References 1. Gritzalis D., Stavrou V., Kandias M., Stergiopoulos G., Insider Threat: Enhancing BPM through Social Media, in Proc. of the 6 th IFIP Interna=onal Conference on New Technologies, Mobility and Security, IEEE Press, Gritzalis D., Kandias M., Stavrou V., Mitrou L., "History of Informa.on: The case of Privacy and Security in Social Media", in Proc. of the History of Informa=on Conference, Law Library Publica.ons, Gritzalis D., Insider threat preven.on through Open Source Intelligence based on Online Social Networks, Keynote address, 13 th European Conference on Cyber Warfare and Security (ECCWS- 2014), Greece, Kandias M., Mylonas A., Virvilis N., Theoharidou M., Gritzalis D., An Insider Threat Predic.on Model, in Proc. of the 7 th Interna=onal Conference on Trust, Privacy and Security in Digital Business, pp , Springer (LNCS 6264), Spain, Kandias M., Galbogini K., Mitrou L., Gritzalis D., "Insiders trapped in the mirror reveal themselves in social media", in Proc. of the 7 th Interna=onal Conference on Network and System Security, pp , Springer, Kandias M., Mitrou L., Stavrou V., Gritzalis D., Which side are you on? A new Panop.con vs. privacy, in Proc. of the 10 th Interna=onal Conference on Security and Cryptography, pp , ScitecPress, Kandias M., Stavrou V., Bozovic N., Mitrou L., Gritzalis D., "Can we trust this user? Predic.ng insider s attude via YouTube usage profiling", in Proc. of 10 th IEEE Interna=onal Conference on Autonomic and Trusted Compu=ng, pp , IEEE Press, Kandias M., Virvilis N., Gritzalis D., "The Insider threat in Cloud Compu.ng", in Proc. of the 6 th Interna=onal Conference on Cri=cal Infrastructure Security, pp , Springer, Kandias M., Stavrou V., Bosovic N., Gritzalis D., Proac.ve insider threat detec.on through social media: The YouTube case, in Proc. of the 12 th Workshop on Privacy in the Electronic Society, pp , ACM, Germany, Kandias M., Mitrou L., Stavrou V., Gritzalis D., "YouTube user and usage profiling: Stories of poli.cal horror and security success", in e- Business and Telecommunica=ons, Springer, Kotzanikolaou P., Theoharidou M., Gritzalis D., Cascading effects of common- cause failures on Cri.cal Infrastructures, in Proc. of the 7 th IFIP Interna=onal Conference on Cri=cal Infrastructure Protec=on, pp , Springer, USA, Mitrou L., Kandias M., Stavrou V., Gritzalis D., "Social media profiling: A Panop.con or Omniop.con tool?", in Proc. of the 6 th Conference of the Surveillance Studies Network, Spain, Pipyros K., Mitrou L., Gritzalis D., Apostolopoulos T., "A cyber aaack evalua.on methodology", in Proc. of the 13 th European Conference on Cyber Warfare and Security, Athens, Theoharidou M., Kotzanikolaou P., Gritzalis D., Risk- based cri.cality analysis", in Proc. of the 3 rd IFIP Interna=onal Conference on Cri=cal Infrastruc- ture Protec=on, Springer, USA, 2009.