\documentclass[11pt,twoside]{article}\makeatletter \IfFileExists{xcolor.sty}% {\RequirePackage{xcolor}}% {\RequirePackage{color}} \usepackage{colortbl} \usepackage{wrapfig} \usepackage{ifxetex} \ifxetex \usepackage{fontspec} \usepackage{xunicode} \catcode`⃥=\active \def⃥{\textbackslash} \catcode`❴=\active \def❴{\{} \catcode`❵=\active \def❵{\}} \def\textJapanese{\fontspec{Noto Sans CJK JP}} \def\textChinese{\fontspec{Noto Sans CJK SC}} \def\textKorean{\fontspec{Noto Sans CJK KR}} \setmonofont{DejaVu Sans Mono} \else \IfFileExists{utf8x.def}% {\usepackage[utf8x]{inputenc} \PrerenderUnicode{–} }% {\usepackage[utf8]{inputenc}} \usepackage[english]{babel} \usepackage[T1]{fontenc} \usepackage{float} \usepackage[]{ucs} \uc@dclc{8421}{default}{\textbackslash } \uc@dclc{10100}{default}{\{} \uc@dclc{10101}{default}{\}} \uc@dclc{8491}{default}{\AA{}} \uc@dclc{8239}{default}{\,} \uc@dclc{20154}{default}{ } \uc@dclc{10148}{default}{>} \def\textschwa{\rotatebox{-90}{e}} \def\textJapanese{} \def\textChinese{} \IfFileExists{tipa.sty}{\usepackage{tipa}}{} \fi \def\exampleFont{\ttfamily\small} \DeclareTextSymbol{\textpi}{OML}{25} \usepackage{relsize} \RequirePackage{array} \def\@testpach{\@chclass \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else \ifnum \@lastchclass=7 5 \else \ifnum \@lastchclass=8 \tw@ \else \ifnum \@lastchclass=9 \thr@@ \else \z@ \ifnum \@lastchclass = 10 \else \edef\@nextchar{\expandafter\string\@nextchar}% \@chnum \if \@nextchar c\z@ \else \if \@nextchar l\@ne \else \if \@nextchar r\tw@ \else \z@ \@chclass \if\@nextchar |\@ne \else \if \@nextchar !6 \else \if \@nextchar @7 \else \if \@nextchar (8 \else \if \@nextchar )9 \else 10 \@chnum \if \@nextchar m\thr@@\else \if \@nextchar p4 \else \if \@nextchar b5 \else \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi \fi} \gdef\arraybackslash{\let\\=\@arraycr} \def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}} \def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}} \def\abbr{} \def\corr{} \def\expan{} \def\gap{} \def\orig{} \def\reg{} \def\ref{} \def\sic{} \def\persName{}\def\name{} \def\placeName{} \def\orgName{} \def\textcal#1{{\fontspec{Lucida Calligraphy}#1}} \def\textgothic#1{{\fontspec{Lucida Blackletter}#1}} \def\textlarge#1{{\large #1}} \def\textoverbar#1{\ensuremath{\overline{#1}}} \def\textquoted#1{‘#1’} \def\textsmall#1{{\small #1}} \def\textsubscript#1{\@textsubscript{\selectfont#1}} \def\textxi{\ensuremath{\xi}} \def\titlem{\itshape} \newenvironment{biblfree}{}{\ifvmode\par\fi } \newenvironment{bibl}{}{} \newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par } \newenvironment{citbibl}{}{\ifvmode\par\fi } \newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi } \newenvironment{docDate}{}{\ifvmode\par\fi } \newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi } \newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par } \newenvironment{msHead}{\vskip 6pt}{\par} \newenvironment{msItem}{\vskip 6pt}{\par} \newenvironment{rubric}{}{} \newenvironment{titlePart}{}{\par } \newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}} \newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}} \newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}} \newcolumntype{P}[1]{){\arraybackslash}p{#1}} \newcolumntype{B}[1]{){\arraybackslash}b{#1}} \newcolumntype{M}[1]{){\arraybackslash}m{#1}} \definecolor{label}{gray}{0.75} \def\unusedattribute#1{\sout{\textcolor{label}{#1}}} \DeclareRobustCommand*{\xref}{\hyper@normalise\xref@} \def\xref@#1#2{\hyper@linkurl{#2}{#1}} \begingroup \catcode`\_=\active \gdef_#1{\ensuremath{\sb{\mathrm{#1}}}} \endgroup \mathcode`\_=\string"8000 \catcode`\_=12\relax \usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry} \usepackage{framed} \definecolor{shadecolor}{gray}{0.95} \usepackage{longtable} \usepackage[normalem]{ulem} \usepackage{fancyvrb} \usepackage{fancyhdr} \usepackage{graphicx} \usepackage{marginnote} \renewcommand{\@cite}[1]{#1} \renewcommand*{\marginfont}{\itshape\footnotesize} \def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif} \pagestyle{fancy} \usepackage[pdftitle={Internal Control of lnformation Sharing through User Security Behavioural Profiling}, pdfauthor={}]{hyperref} \hyperbaseurl{} \paperwidth210mm \paperheight297mm \def\@pnumwidth{1.55em} \def\@tocrmarg {2.55em} \def\@dotsep{4.5} \setcounter{tocdepth}{3} \clubpenalty=8000 \emergencystretch 3em \hbadness=4000 \hyphenpenalty=400 \pretolerance=750 \tolerance=2000 \vbadness=4000 \widowpenalty=10000 \renewcommand\section{\@startsection {section}{1}{\z@}% {-1.75ex \@plus -0.5ex \@minus -.2ex}% {0.5ex \@plus .2ex}% {\reset@font\Large\bfseries}} \renewcommand\subsection{\@startsection{subsection}{2}{\z@}% {-1.75ex\@plus -0.5ex \@minus- .2ex}% {0.5ex \@plus .2ex}% {\reset@font\Large}} \renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}% {-1.5ex\@plus -0.35ex \@minus -.2ex}% {0.5ex \@plus .2ex}% {\reset@font\large}} \renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}% {-1ex \@plus-0.35ex \@minus -0.2ex}% {0.5ex \@plus .2ex}% {\reset@font\normalsize}} \renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}% {1.5ex \@plus1ex \@minus .2ex}% {-1em}% {\reset@font\normalsize\bfseries}} \def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt} \@tempdima 1.5em \begingroup \parindent \z@ \rightskip \@pnumwidth \parfillskip -\@pnumwidth \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par \endgroup} \def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}} \def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}} \def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}} \def\l@subparagraph{\@dottedtocline{5}{10em}{5em}} \@ifundefined{c@section}{\newcounter{section}}{} \@ifundefined{c@chapter}{\newcounter{chapter}}{} \newif\if@mainmatter \@mainmattertrue \def\chaptername{Chapter} \def\frontmatter{% \pagenumbering{roman} \def\thechapter{\@roman\c@chapter} \def\theHchapter{\roman{chapter}} \def\thesection{\@roman\c@section} \def\theHsection{\roman{section}} \def\@chapapp{}% } \def\mainmatter{% \cleardoublepage \def\thechapter{\@arabic\c@chapter} \setcounter{chapter}{0} \setcounter{section}{0} \pagenumbering{arabic} \setcounter{secnumdepth}{6} \def\@chapapp{\chaptername}% \def\theHchapter{\arabic{chapter}} \def\thesection{\@arabic\c@section} \def\theHsection{\arabic{section}} } \def\backmatter{% \cleardoublepage \setcounter{chapter}{0} \setcounter{section}{0} \setcounter{secnumdepth}{2} \def\@chapapp{\appendixname}% \def\thechapter{\@Alph\c@chapter} \def\theHchapter{\Alph{chapter}} \appendix } \newenvironment{bibitemlist}[1]{% \list{\@biblabel{\@arabic\c@enumiv}}% {\settowidth\labelwidth{\@biblabel{#1}}% \leftmargin\labelwidth \advance\leftmargin\labelsep \@openbib@code \usecounter{enumiv}% \let\p@enumiv\@empty \renewcommand\theenumiv{\@arabic\c@enumiv}% }% \sloppy \clubpenalty4000 \@clubpenalty \clubpenalty \widowpenalty4000% \sfcode`\.\@m}% {\def\@noitemerr {\@latex@warning{Empty `bibitemlist' environment}}% \endlist} \def\tableofcontents{\section*{\contentsname}\@starttoc{toc}} \parskip0pt \parindent1em \def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}} \newenvironment{reflist}{% \begin{raggedright}\begin{list}{} {% \setlength{\topsep}{0pt}% \setlength{\rightmargin}{0.25in}% \setlength{\itemsep}{0pt}% \setlength{\itemindent}{0pt}% \setlength{\parskip}{0pt}% \setlength{\parsep}{2pt}% \def\makelabel##1{\itshape ##1}}% } {\end{list}\end{raggedright}} \newenvironment{sansreflist}{% \begin{raggedright}\begin{list}{} {% \setlength{\topsep}{0pt}% \setlength{\rightmargin}{0.25in}% \setlength{\itemindent}{0pt}% \setlength{\parskip}{0pt}% \setlength{\itemsep}{0pt}% \setlength{\parsep}{2pt}% \def\makelabel##1{\upshape ##1}}% } {\end{list}\end{raggedright}} \newenvironment{specHead}[2]% {\vspace{20pt}\hrule\vspace{10pt}% \phantomsection\label{#1}\markright{#2}% \pdfbookmark[2]{#2}{#1}% \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}% }{} \def\TheFullDate{2012-08 2014-01-15 (revised: August 2012]. 15 January 2014)} \def\TheID{\makeatother } \def\TheDate{2012-08 2014-01-15} \title{Internal Control of lnformation Sharing through User Security Behavioural Profiling} \author{}\makeatletter \makeatletter \newcommand*{\cleartoleftpage}{% \clearpage \if@twoside \ifodd\c@page \hbox{}\newpage \if@twocolumn \hbox{}\newpage \fi \fi \fi } \makeatother \makeatletter \thispagestyle{empty} \markright{\@title}\markboth{\@title}{\@author} \renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@ \belowdisplayskip \abovedisplayskip \abovedisplayshortskip \z@ plus2\p@ \belowdisplayshortskip 4\p@ plus2\p@ minus2\p@ \def\@listi{\leftmargin\leftmargini \topsep 2\p@ plus1\p@ minus1\p@ \parsep 2\p@ plus\p@ minus\p@ \itemsep 1pt} } \makeatother \fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm} \fancyhf{} \setlength{\headheight}{14pt} \fancyhead[LE]{\bfseries\leftmark} \fancyhead[RO]{\bfseries\rightmark} \fancyfoot[RO]{} \fancyfoot[CO]{\thepage} \fancyfoot[LO]{\TheID} \fancyfoot[LE]{} \fancyfoot[CE]{\thepage} \fancyfoot[RE]{\TheID} \hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true} \fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}} \date{} \usepackage{authblk} \providecommand{\keywords}[1] { \footnotesize \textbf{\textit{Index terms---}} #1 } \usepackage{graphicx,xcolor} \definecolor{GJBlue}{HTML}{273B81} \definecolor{GJLightBlue}{HTML}{0A9DD9} \definecolor{GJMediumGrey}{HTML}{6D6E70} \definecolor{GJLightGrey}{HTML}{929497} \renewenvironment{abstract}{% \setlength{\parindent}{0pt}\raggedright \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}} \vskip16pt \textcolor{GJBlue}{\large\bfseries\abstractname\space} }{% \vskip8pt \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}} \vskip16pt } \usepackage[absolute,overlay]{textpos} \makeatother \usepackage{lineno} \linenumbers \begin{document} \author[1]{Suchinthi Fernando} \author[2]{Takashi Yukawa} \affil[1]{ Nagaoka University of Technology} \renewcommand\Authands{ and } \date{\small \em Received: 6 December 2013 Accepted: 2 January 2014 Published: 15 January 2014} \maketitle \begin{abstract} This paper presents a workable solution to address the human-related information security problem of improper sharing of information by insiders with outsiders or unauthorized insiders. This system differs from most currently available information security solutions as in that, instead of relying solely on technological security measures it adapts a mixture of social and technological solutions. The presented system monitors users' security best practices and behavioural patterns and creates user security behavioural profiles and thus identifies users who might potentially pose threats to the organization's information security. The system then determines and schedules the security education and training to be given to these users. \end{abstract} \keywords{information security, human behaviour, personality type, profiling, social, technological, insider threat.} \begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) \textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark} \end{textblock*} \begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) \textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}} \end{textblock*} \let\tabcellsep& \section[{Introduction}]{Introduction}\par s the importance of considering human resource security has become apparent \hyperref[b0]{(Asai, 2007)}, information security is no longer considered a purely technological matter.\par Ensuring that access to information is strictly limited to the personnel who need to know it in order to perform their assigned tasks is mandatory to succeed in business \hyperref[b1]{(Schweitzer, 1996}). Yet, as \hyperref[b2]{Bean (2008)} states, most identified information security breaches occur because of human errors, resulting from the lack of proper knowledge and training, ignorance and failure to follow procedures. Thus, being the weakest link in the chain of security, people may unintentionally reveal confidential information to others. \hyperref[b3]{Schneier (2008)} explains how the perception of security diverges from its reality and how people feel secure as long as there is no visible threat. This human weakness is exploited in most present-day attacks, such as social engineering, spear phishing or collusion from an insider, where people are tricked into revealing confidential information to others, and thus require a human element to be completed successfully {\ref (Williams, 2011)}.\par With the inclusion of users with non-malicious intent, the percentage of insiders wittingly or unwittingly involved in an attack originating from the inside is said to be at least 60\%-80\% {\ref (Lynch, 2012;} {\ref Grimes, 2012}). An insider threat is defined as "trusted users with legitimate access abusing system privileges \hyperref[b6]{(Liu et al. 2005)}, or as "intentionally disruptive, unethical, or illegal behaviour enacted by individuals possessing substantial internal access to an organization's information assets" \hyperref[b7]{(Mills et al. 2011}). Insider attacks are indistinguishable or difficult to distinguish from normal actions as inside attackers have authorization to access and use the system and these actions are less likely to differ from the norm \hyperref[b6]{(Liu et al. 2005)}.\par Vroom and von Solms (2003) explain that physical, technical and operational controls are used to carry out effective information security, where the operational controls concern the behaviour and actions of the employees. Yet, even though information systems security auditing ensures that an organization's security policies, procedures and regulations are effective, the adherence of employees to these audited policies is simply assumed \hyperref[b8]{(Vroom and von Solms, 2003)}. Thus, despite the overall understanding that the human factor should be taken into consideration in information security management (ISM), most security solutions available today still rely on purely technical measures to enforce information security. Although most technical security measures may be somewhat sufficient to keep outside attacks at bay, technical measures alone are clearly insufficient to ward off insider attacks, since, people may easily bypass these technological controls and restrictions such as access control by revealing their authentication information to others. \hyperref[b9]{Sabett (2011)} states that security systems should be designed by accepting that the bad guys are already inside the system. Human behaviour, which is performed according to the personality of the individual, can be categorized (Vrooms and von Solms, 2003). Observable behaviours include cyber activities, which provide only limited insight into intent and character, but are easier to collect, process, and correlate automatically, as well as personal conduct, which is observed through background checks \hyperref[b7]{(Mills et al, 2011)} or a "walkabout" after normal working hours to look for key indicators of information security awareness such as whether the offices, desks and cabinets are locked, workstations, information and recording media are secured, etc. \hyperref[b10]{(Peltier, 2002)}. Personnel may be categorized according to job category, job function, their knowledge about information processing and technology, system or application used, as well as level of awareness. \hyperref[b10]{Peltier (2002)} further discusses the methods used to convey the awareness message, where he states that a handson approach would be an efficient method of training, while the best method for awareness is to watch a video on the subject. He also mentions the importance of an informed outsider presenting the message as opposed to a known messenger doing so, and further states that awareness programmes must be scheduled around the work patterns of the audience and that the mornings on Tuesdays, Wednesdays or Thursdays would be the best \hyperref[b10]{(Peltier, 2002)}. Gonzales and Sawicka (2002) state that if security measures stay above a certain threshold and the risk is kept below the accident zone, accidents will not normally happen. Typically, perceived risk and compliance with security measures gradually decline when accidents do not occur as a consequence of improved security. Thus, they recommend risk perception renewals in order to sustain an appropriate level of risk perception through properly scheduled interventions such as security training and awareness programmes (Gonzales and Sawicka, 2002). Foley (2011) lists the requirements for a proactive and sustainable security programme to be: preventive (credentialing and restricting access through authorization of identity, time, and place), detective (auditing, monitoring, and referrals to validate allegation), corrective (additional monitoring or auditing, updating credentials, access restriction, or access removal), and feedback (dynamic, reactive, and planned feedback and creating and implementing solutions).\par The system presented through this research incorporates these suggestions by blending social and technological solutions to monitor cyber and non-cyber activities of users, detect patterns among these behaviours, and use this information together with background information and job details to create security behavioural profiles to identify users who might potentially be problematic. The system then determines the level of security education or guidance needed and thereby schedules and either conducts automatic security awareness programmes or informs management of training sessions to be conducted. In addition, the system also conducts periodic risk perception renewals in order to maintain the risk perception level within the appropriate limit. \section[{II.}]{II.} \section[{Presented System}]{Presented System}\par The system presented through this research to achieve internal control of information sharing is explained briefly in this section. The detailed explanation of this system is available in \hyperref[b13]{(Fernando and Yukawa, 2013)}. \hyperref[b14]{Lacey (2009)} has pointed out that curtailing or limiting the personal browsing ability of employees is detrimental to their productivity. Yet, depending on the criticality of the business information the employee has to access, it is sometimes mandatory to restrict web browsing and access to the Internet in order to protect the security of the business information of that particular project. In some instances, the clients themselves specifically request such restrictions. This system addresses this problem by providing two separate modes: the "strict" mode, which is the default mode, and the "relaxed" mode, which needs to be specifically activated. Only pre-specified, work-related programs and services are allowed during the "strict" mode, and all activities are monitored and logged, while personal browsing, e-mails, or instant messaging, etc. are disallowed, and all information exchanges (e-mail contents, attachments, file-sharing, etc.) are recorded. During the "relaxed" mode, personal browsing, personal e-mails, instant messaging, etc., are allowed, and are not monitored to protect the user's privacy, while access to work-related information is disallowed. Fig. \hyperref[fig_0]{1} depicts the top level architectural design of the system. This system constantly monitors for extraordinary behaviour: excessive or untimely access to information, services, or systems, access from remote terminals, attempts to access data of a higher classification level than the user's security clearance level, or data for which the user has no Need-to-Know according to their job description and the projects they are currently working on. Additionally, employees' observance of best practices is monitored regularly in the areas of password security behaviour, data backup behaviour, data sanitization behaviour, network security behaviour, and physical security behaviour.\par Cyber activities of users such as password renewal frequency, reuse of former passwords, password strength, and data-backup frequency, etc. will be regularly monitored automatically by the system. Non-cyber activities such as whether the users leave confidential documents lying around, whether doors are locked, whether credentials are validated before revealing information to others, etc. will be monitored personally, during or after work hours, by their managers or the security personnel of the organization. Information from background checks conducted before employment and periodically during employment is inputted to the system by human resource managers. These include: contact details, financial status and stability, number of dependents, education level, criminal record, etc. Employee's job description will be inputted or updated by their manager according to the project(s) they are working on. Responsibility entailing the job and the records of performance evaluations will be included. Together, this information will be used for profiling and for finding the behavioural types each of the employees belong to. The resulting security behavioural profiles will include the security consciousness of the employee, the extent of understanding and the value given to ISM rules and procedures, the extent of adherence to policies, how easily an employee can be enticed or tricked into revealing information, employee's ambitiousness and drive to move ahead in their career, sociability, capability to work in a team, and respect gained by peers, the employee's potential to intentionally or unintentionally reveal or improperly share confidential information, and whether the employee has any motive or incentive (financial, career-wise, social, psychological, or personal) to access unauthorized information or improperly reveal information to others. \section[{Profiling}]{Profiling}\par An insight into criminal investigations, the prevailing area in the field of security to use profiling, helps to better understand the security profiling techniques to be adapted for an information security system. Criminal profiling, used in homicide, sexual assault, arson, etc., is an investigative approach based on the premise that the crime scene provides details about offense and offender \hyperref[b15]{(Young and Varano, 2006)} and is the careful evaluation of physical evidence for systematically reconstructing the crime scene and developing a strategy to capture the offender, by weeding out suspects, developing an investigative strategy, linking crimes and suspects, and assessing risk \hyperref[b16]{(Thompson, 2011)}. Based on the premise that "every criminal works to a certain set of values", criminal profiling is used to classify behavioural patterns and predict the next move (Claridge, 2012). The developed offender description contains: psychological variables (personality traits, psychopathologies, and behaviour patterns), and demographic variables (age, race, gender, emotional age, marital status, socioeconomic level, occupation, level of education, arrest and offense history, etc.) {\ref (Winerman, 2004)}. Criminal profiling uses geographic or psychological typologies to create a profile that isolates offender characteristics \hyperref[b15]{(Young and Varano, 2006)}. Of these, the presented system uses a psychologically-based technique, which compiles psychological background using observable behaviours of offender's traits. Behaviour is interpreted from the presence or absence of forensic elements, offender's behavioural choices, modus operandi, signature behaviours, knowledge of crime scene's dynamics, etc. \hyperref[b15]{(Young and Varano, 2006)}. Turvey {\ref (2000)} states that inductive criminal profiling entails broad generalization and statistical reasoning and is thus subjective, whereas, deductive criminal profiling, based on behavioural evidence analysis, is a dynamic process which could be used to capture successful criminals whose methods either become more refined or deteriorate over time. \hyperref[b14]{Lacey (2009)} states that the Myers Briggs Type Indicator (MBTI) instrument could be used to categorize user psychological types and would therefore enable profiling to be applied to information security. Carl Jung's Theory of Psychological Types states that much seemingly random variation in human behaivour is actually quite orderly and consistent, being due to basic differences in the way individuals prefer to use their perception and judgement. According to the Myers \& Briggs Foundation (n. d.), MBTI is based on Jung's ideas about perception and judgement and the attitudes in which these are used in different types of people to identify basic preferences of each of the four dichotomies specified or implicit in Jung's theory and to indentify and describe the sixteen distinctive personality types resulting from the interactions among these preferences. Perception is defined as "all the ways of becoming aware of things, people, happenings or ideas", while judgement is defined as "all the ways of coming to conclusions about what has been perceived". It is further stated that if people differ systematically in what they perceive and in how they reach conclusions, then it is only reasonable for them to differ correspondingly in their interests, reactions, values, motivations, and skills (The Myers \& Briggs Foundation, n.d.). The four dichotomies explained by the Myers \& Briggs Foundation are summarized below:\par ? Favourite world: Extraversion or Introversion (E-I) are mutually complementary attitudes. Extraverts are oriented primarily toward the outer world focusing their perception and judgement on people and objects, while introverts are primarily oriented toward the inner world focusing their perception and judgement upon concepts and ideas.\par ? Information: Sensing or Intuition (S-N) are opposite ways of perceiving information, either focusing on basic information or interpreting and adding meaning. Sensing relies primarily upon the process of sensing, which reports observable facts or happenings through one or more of the five senses, while intuition relies upon the less obvious process of intuition, which reports meanings, relationships and/or possibilities that have been worked out beyond the reach of the conscious mind. ? Decisions: Thinking and Feeling (T-F) are contrasting ways of judgement, either looking at logic and consistency or looking at people and special circumstances. Thinking decides impersonally on the basis of logical consequences, while feeling decides primarily on the basis of personal or social value.\par ? Structure: Judging or Perceiving (J-P) are processes used in dealing with the outer world (the extraverted part of life). Judging uses a judgement process (thinking or feeling) and thus gets things decided, while perceiving uses a perceptive process (sensing or intuition) and stays open to new information and options.\par One pole of each of the four preferences is dominant over the other (auxiliary) pole and these preferences on each index are independent of preferences for the other three indices, yielding sixteen possible combinations (The Myers \& Briggs Foundation, n. d.). Table \hyperref[tab_0]{1} lists these sixteen personality types. \hyperref[b14]{Lacey (2009)} emphasizes that MBTI can indicate who is likely to commit a fraud, but cannot explicitly say who will commit a fraud. In this research MBTI is used for validating the behaviours profiled by the presented system.\par The behavioural characteristics shown in Table \hyperref[tab_1]{2} are assumed for each of the following observable behavioural patterns when creating the user security behavioural profiles. The system allows these rules to be configured by the ISO to be aligned with the organization's business objectives. The default values are listed in Table \hyperref[tab_1]{2}.\par "N" depicts not having the corresponding characteristic, while "Y" depicts having that characteristic. The characteristics not relevant to a corresponding observable behaviour are coloured in grey. Thus, according to the default values, the security behavioural profile for an employee who leaves items unattended, for example, will contain the characteristics of not being security conscious, easily revealing information, not valuing or understanding ISM rules, and having a potential for improper sharing of information. \section[{Behavioural Profile Viewing}]{Behavioural Profile Viewing}\par To test this system, the authors created ten hypothetical test case scenarios as shown in Table \hyperref[tab_2]{3}. Table \hyperref[tab_3]{4} displays the automatically monitored and computed cyber activity for these ten hypothetical employees, while table \hyperref[tab_4]{5} shows the personal views about non-cyber activities of the employees observed and inputted by managers and security personnel. The algorithms used for computing security behavioural profiles and for scheduling security awareness training are explained in detail in {\ref (Fernando and} \hyperref[tab_5]{6}, while fig. \hyperref[fig_3]{2} depicts the graphical representation of her profile. The random schedule for periodic risk perception renewal is set in 4 weeks from the coming Tuesday for all employees. This security awareness training will likely consist of a pop-up presentation about security best practices followed by a questioning session to check the employees' understanding of security awareness. For employees who have a potential for improper information sharing, a hands-on security workshop conducted by external security professionals will be scheduled in 2 weeks from the coming Wednesday. If an employee has the potential for unauthorized access to information, the system will schedule a security seminar by security managers and legal officials in a week from the coming Wednesday. For employees who are deemed to have any kind of motive for engaging in improper information sharing or unauthorized access, the system will schedule closer inspection including background checks in 2 weeks from the coming Thursday. Thus, the training schedules computed on 30 th September 2013 for an employee who requires all four types of security training will include a random awareness training on Tuesday, 29 th October 2013, a security workshop on Wednesday, 16 th October 2013, a security seminar on Wednesday, 9th October 2013, and a security inspection on Thursday, 17 th October 2013. Fig. 3 displays these security training schedules for Samantha Colt (Emp0008) graphically on a calendar.\par The summarized and graphical views of security behavioural profiles allow the ISO and the security managers to comprehend the major infractions by an employee at a glance, whereas, the detailed view provides more details about these infractions. Table {\ref 7} summarizes the resulting profiles obtained through the security behavioural profiling system on 30th September 2013. These results show that employees Monica White (Emp0002), Shaun Mills (Emp0003), Jacob Call (Emp0005), Samantha Colt (Emp0008) and Gavin Fields (Emp0009) have security behavioural flaws that could lead to information security problems along with motives or incentives, and thus need the hands-on training workshop, security educational seminar and closer inspection, along with the random security awareness. Employee Martha Hall (Emp0001), on the other hand, requires only the handson training workshop and closer inspection, along with the random security awareness programme. Employees John Flynn (Emp0004) and Faith Stellar (Emp0006) do not engage in any wrongful security behaviour, but their knowledge about computers and their background information show that they still require the security seminar showing the legal aspects of security violations as deterrence, along with closer inspection and the random security awareness. Employee Sarah Mason (Emp0010) is too new for the system to identify her security traits yet, but since she has already tried to access data without Need-to-Know once, and due to her background information, she requires the hands-on training workshop and security seminar, along with the random security awareness. Employee Claire McCormick (Emp0007), however, is an example of a case where the personal views of her manager might be biased. Her cyber activities and background information show that she does not engage in any wrongful security behaviour, but the personal views state otherwise. In this instance, the ISO can request separate views of her security profile, and upon seeing that the personal observations by her manager contradict the rest of her security traits determined by the system, can use his or her own personal judgement to avoid any personal bias this employee's manager might have towards her, and thereby decide whether she requires the hands-on training workshop, or whether closer inspection and the random security awareness programme are sufficient. Table {\ref 8} depicts the MBTI personality types and resulting personalities of the employees as deemed true by the system according to the monitored cyber and non-cyber activities, and background information. The resulting personalities for each of the personality types listed in table 1 are adapted from the Myers \& Briggs Foundation (n.d.). A "?" mark is used to depict an indeterminable dichotomy of personal preference, in which case the personality type and personality cannot be determined completely.\par By comparing the data in table 8, concerning the personalities of the employees, with the resulting behavioural profiles in table 7, it can be seen that MBTI personality types and their resulting personalities match the behavioural profiles with sufficient accuracy. Thus, it is safe to assume that in the case the MBTI personality types of the employees of an organization are determined it could be used to provide insight into the behavioural patterns of the employees to a certain extent.\par V. \section[{Conclusions and Future work}]{Conclusions and Future work}\par In conclusion, it can be stated that the system presented through this research provides a workable solution to achieve internal control of information sharing within an organization. By examining the automatically monitored cyber activities of the employees, their personally observed non-cyber activities, and their background information, the system compiles security behavioural profiles showing which of the employees could potentially engage in which wrongful activities that could present a threat to the organization's information security. Accordingly, the system also determines and schedules the level and type of security education and training to be given to each individual employee.\par Through the results obtained by testing the system presented above with the hypothetical test cases, it can be stated that this system can be used for effective prediction of security infractions by employees within an organization to a certain extent.\par By allowing observable information about employees' behaviour to be inputted personally by managers and security personnel, and through automatic monitoring of cyber-activities of employees, this system attempts to handle the human-related problem of improper information sharing using both technological and social information gathering methods. It also provides a mixture of technological and social solutions by means of automatic access control, logging, and risk perception renewals by the system along with hands on security awareness and training workshops conducted by security professionals, and the allowing of the use of personal judgement by the ISO. By providing a mix of social and technological solutions, the system enables an organization to provide a workable socio-technological solution to this humanrelated problem of information security and thereby overcomes the weaknesses of a purely technological solution.\par Monitoring of employees' activities does, however, produce privacy implications. This system keeps such implications to a minimal by providing the two separate "strict" and "relaxed" modes to clearly distinguish the times when monitoring of activities will or will not be conducted.\par By allowing the ISO to configure the security behavioural rules to be aligned with the business objectives of the organization, this system can be tailormade to suit the specific requirements of the organization. Further, the summarized, detailed, graphical and separate views of security behavioural profiles and the graphical display of training schedules provide convenience to the ISO and security managers.\par As future work, currently existing common algorithms could be reused with modifications and integrated to the implementation of this system to cover all the areas of monitoring of security behaviour proposed through this research. In addition, the system could be deployed and put to use on real people in order to obtain real test results to further evaluate the system's functionality. - - - - - - - - - - - - Y - Does not forget keys Y - - - - - - - - - - - - - - Leaves items unattended N Y N - - - - - - - - - - Y - Does not leave items Y N - - - - - - - - - - - - - Sociable - - - Y - - - - - - - - - - - Not sociable - - - N - - - - Y - - - - - - Ambitious - - - - Y - - - - Y - - - - Y Not ambitious - - - - N - - - - - - - - - - Writes down passwords N Y - - - - - - - - - - - Y - Does not write passwords Y - - - - - - - - - - - - - - Lends keys/PINs - Y - - - - - - Y - - - - Y - Does not lend keys/PINs - N - - - - - - - - - - - - - Security conscious Y - - - - - - - - - - - - - - Not security conscious N - - - - - - - - - - - - Y - Understands/values ISM rules - - Y - - - - - - - - - - - - Does not understand /value ISM rules - - N - - - - - - - - - - Y - Background Information -Marital Status, Dependents, Academic Record, Financial Status, Criminal Record Married - - - - - Y - Unmarried Y - - - - - - Divorced - - Y - - - - Widowed - - - - - - - Dependents Y 2 BS/MS in Computers Y Y No BA/BS/MS Y Low income Y Has criminal record Y Y Cyber Activities -Password Strength Very weak - - - - - - Y - - - - - - - - Weak - - - - - - Y - - - - - - - - Medium - - - - - - - - - - - - - - - Strong Y - - - - - - - - - - - - - - Cyber Activities -Password Modification Frequency Infrequent N - N - - - Y - - - - - - Y - Few times a year N - N - - - Y - - - - - - Y - Monthly - - - - - - - - - - - - - - - Every 2 weeks - - - - - - - - - - - - - - - Weekly - - - - - - - - - - - - - - - Excessively - - - - - - - Y - - - - - - Y Recent activity - - - - - - - Y - - - - - - Y Cyber Activities -Password Reuse Ten times or over N - N - - - Y - - - - - - Y - 0 Six-to-nine times N - N - - - Y - - - - - - Y - 0 Three-to-five times N - N - - - Y - - - - - - Y - 1 Cyber Activities -Attempts to Access Data without Authorization Over clearance - - N - - - - Y - - - - - - Y 0 No need-to-know - - N - - - - Y - - - - - - Y 0 Cyber Activities -Backup Frequency Infrequent N - N - - - - - - - - - - - - Weekly - - - - - - - - - - - - - - - Daily - - - - - - - - - - - - - - - Excessively - - - - Y - - Y - - - - - Y - Recent activity - - - - - - - Y - - - - - Y -\begin{figure}[htbp] \noindent\textbf{1}\includegraphics[]{image-2.png} \caption{\label{fig_0}Figure 1 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{}\includegraphics[]{image-3.png} \caption{\label{fig_1}Internal}\end{figure} \begin{figure}[htbp] \noindent\textbf{}\includegraphics[]{image-4.png} \caption{\label{fig_2}}\end{figure} \begin{figure}[htbp] \noindent\textbf{2}\includegraphics[]{image-5.png} \caption{\label{fig_3}Figure 2 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{1} \par \begin{longtable}{P{0.85\textwidth}} 7. Grimes, R. A. (2010) How to thwart employee\\ cybercrime. Insider Threat Deep Drive -Combating\\ the Enemy Within, InfoWorld -Special Report, pp. 2-\\ 7 [Online]. Available from: http://resources.\\ idgenterprise.com/original/AST-0001528\textunderscore insiderthre\\ at\textunderscore 2\textunderscore v1.pdf [Accessed 5 th August 2012].\end{longtable} \par \caption{\label{tab_0}Table 1 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{2} \par \begin{longtable}{P{0.04927536231884058\textwidth}P{0.04681159420289855\textwidth}P{0.04681159420289855\textwidth}P{0.04681159420289855\textwidth}P{0.12072463768115942\textwidth}P{0.01971014492753623\textwidth}P{0.02217391304347826\textwidth}P{0.04681159420289855\textwidth}P{0.03942028985507246\textwidth}P{0.04927536231884058\textwidth}P{0.03942028985507246\textwidth}P{0.05173913043478261\textwidth}P{0.03695652173913043\textwidth}P{0.03942028985507246\textwidth}P{0.04927536231884058\textwidth}P{0.03942028985507246\textwidth}P{0.02217391304347826\textwidth}P{0.04681159420289855\textwidth}P{0.02217391304347826\textwidth}P{0.014782608695652174\textwidth}} Activity\tabcellsep Security Conscious\tabcellsep Reveals Information\tabcellsep Values/ Understands\tabcellsep ISM Rules\tabcellsep Sociable\tabcellsep Ambitious\tabcellsep Technical Knowledge\tabcellsep Easy Hack Target\tabcellsep Suspicious Behaviour\tabcellsep Social Incentive\tabcellsep Career-wise Incentive\tabcellsep Personal Motive\tabcellsep Financial Motive\tabcellsep Psychological Motive\tabcellsep Improper Sharing\tabcellsep Potential\tabcellsep Unauthorized Access\tabcellsep Potential\tabcellsep Number\\ \tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{7}{l}{Personally Observed Non-Cyber Activities}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\ Forgets keys\tabcellsep N\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par \caption{\label{tab_1}Table 2 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{3} \par \begin{longtable}{P{0.22724489795918365\textwidth}P{0.014744897959183673\textwidth}P{0.09627551020408164\textwidth}P{0.05724489795918367\textwidth}P{0.025153061224489796\textwidth}P{0.32785714285714285\textwidth}P{0.028622448979591836\textwidth}P{0.07285714285714286\textwidth}} ID\tabcellsep Name\tabcellsep Designation\tabcellsep Marital\tabcellsep \multicolumn{2}{l}{Dependents Academic}\tabcellsep Financial\tabcellsep Criminal Record\\ \tabcellsep \tabcellsep \tabcellsep Status\tabcellsep \tabcellsep Record\tabcellsep Status\\ \multicolumn{4}{l}{Emp0001 Martha Hall Accountant Unmarried}\tabcellsep 0\tabcellsep \multicolumn{3}{l}{BA -Accounting Steady income None}\\ \multicolumn{3}{l}{Emp0002 Monica White Software}\tabcellsep Married\tabcellsep 1\tabcellsep BS -Computer\tabcellsep \multicolumn{2}{l}{Steady income None}\\ \tabcellsep \tabcellsep Engineer\tabcellsep \tabcellsep \tabcellsep Science\tabcellsep \\ \multicolumn{3}{l}{Emp0003 Shaun Mills Computer}\tabcellsep Divorced\tabcellsep 1\tabcellsep \multicolumn{2}{l}{Computer Tech Low income}\tabcellsep Juvenile breaking and\\ \tabcellsep \tabcellsep Operator\tabcellsep \tabcellsep \tabcellsep Certification\tabcellsep \tabcellsep entering\\ \multicolumn{2}{l}{Emp0004 John Flynn}\tabcellsep Software\tabcellsep Widowed\tabcellsep 2\tabcellsep \multicolumn{3}{l}{MS -Computer Steady income Teenaged hacking into}\\ \tabcellsep \tabcellsep Engineer\tabcellsep \tabcellsep \tabcellsep Engineering\tabcellsep \tabcellsep Federal Database\\ \multicolumn{2}{l}{Emp0005 Jacob Call}\tabcellsep Computer\tabcellsep Married\tabcellsep 3\tabcellsep \multicolumn{2}{l}{Computer Tech Low income}\tabcellsep None\\ \tabcellsep \tabcellsep Operator\tabcellsep \tabcellsep \tabcellsep Certification\tabcellsep \\ \multicolumn{3}{l}{Emp0006 Faith Stellar Software}\tabcellsep Divorced\tabcellsep 1\tabcellsep \multicolumn{3}{l}{MS -Computer Steady income None}\\ \tabcellsep \tabcellsep Engineer\tabcellsep \tabcellsep \tabcellsep Engineering\tabcellsep \\ \multicolumn{2}{l}{Emp0007 Clair}\tabcellsep \multicolumn{2}{l}{Accountant Unmarried}\tabcellsep 0\tabcellsep \multicolumn{3}{l}{BA -Accounting Steady income None}\\ \tabcellsep McCormick\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\ \multicolumn{2}{l}{Emp0008 Samantha}\tabcellsep Computer\tabcellsep Unmarried\tabcellsep 1\tabcellsep \multicolumn{2}{l}{Computer Tech Low income}\tabcellsep Juvenile shoplifting\\ \tabcellsep Colt\tabcellsep Operator\tabcellsep \tabcellsep \tabcellsep Certification\tabcellsep \\ \multicolumn{4}{l}{Emp0009 Gavin Fields Accountant Divorced}\tabcellsep 3\tabcellsep \multicolumn{3}{l}{BA -Accounting Steady income None}\\ \multicolumn{3}{l}{Emp0010 Sarah Mason Software}\tabcellsep Widowed\tabcellsep 2\tabcellsep \multicolumn{3}{l}{MS -Computer Steady income None}\\ \tabcellsep \tabcellsep Engineer\tabcellsep \tabcellsep \tabcellsep Engineering\tabcellsep \end{longtable} \par \caption{\label{tab_2}Table 3 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{4} \par \begin{longtable}{P{0.09857142857142857\textwidth}P{0.011428571428571429\textwidth}P{0.5257142857142857\textwidth}P{0.10142857142857144\textwidth}P{0.065\textwidth}P{0.02142857142857143\textwidth}P{0.02642857142857143\textwidth}} ID\tabcellsep Password\tabcellsep Password\tabcellsep Password Modifying\tabcellsep Backup Frequency\tabcellsep Access Over\tabcellsep Access Without Need-\\ \tabcellsep Strength\tabcellsep Reuse\tabcellsep Frequency\tabcellsep \tabcellsep Clearance\tabcellsep to-Know\\ \multicolumn{2}{l}{Emp0001 Medium}\tabcellsep 19\textunderscore 0\textunderscore 1\textunderscore 2\textunderscore 3\tabcellsep Every 2 weeks\tabcellsep Daily\tabcellsep 0\tabcellsep 0\\ \multicolumn{2}{l}{Emp0002 Medium}\tabcellsep 12\textunderscore 0\textunderscore 0\textunderscore 2\textunderscore 5\tabcellsep Weekly\tabcellsep Excessive\tabcellsep 0\tabcellsep 2\\ \multicolumn{2}{l}{Emp0003 Weak}\tabcellsep \multicolumn{2}{l}{20 \textunderscore 0 \textunderscore 1\textunderscore 2\textunderscore 2 Excessive}\tabcellsep Excessive\tabcellsep 2\tabcellsep 1\\ \multicolumn{2}{l}{Emp0004 Strong}\tabcellsep \multicolumn{2}{l}{13\textunderscore 0\textunderscore 0\textunderscore 0\textunderscore 12 Every 2 weeks}\tabcellsep Weekly\tabcellsep 0\tabcellsep 0\\ \multicolumn{2}{l}{Emp0005 Medium}\tabcellsep 3\textunderscore 0\textunderscore 0\textunderscore 0\textunderscore 3\tabcellsep Few times yearly\tabcellsep Infrequent\tabcellsep 1\tabcellsep 0\\ \multicolumn{2}{l}{Emp0006 Strong}\tabcellsep 8\textunderscore 0\textunderscore 0\textunderscore 0\textunderscore 8\tabcellsep Monthly\tabcellsep Daily\tabcellsep 0\tabcellsep 0\\ \multicolumn{2}{l}{Emp0007 Medium}\tabcellsep 7\textunderscore 0\textunderscore 0\textunderscore 1\textunderscore 4\tabcellsep Monthly\tabcellsep Weekly\tabcellsep 0\tabcellsep 0\\ \multicolumn{2}{l}{Emp0008 Weak}\tabcellsep 2\textunderscore 0\textunderscore 0\textunderscore 0\textunderscore 2\tabcellsep Infrequent\tabcellsep Infrequent\tabcellsep 5\tabcellsep 5\\ \multicolumn{2}{l}{Emp0009 Medium}\tabcellsep 18\textunderscore 0\textunderscore 0\textunderscore 3\textunderscore 2\tabcellsep Recent activity\tabcellsep Recent activity\tabcellsep 2\tabcellsep 3\\ \multicolumn{2}{l}{Emp0010 Strong}\tabcellsep 3\textunderscore 0\textunderscore 0\textunderscore 0\textunderscore 3\tabcellsep \multicolumn{2}{l}{Too new to determine Too new to determine}\tabcellsep 0\tabcellsep 1\end{longtable} \par \caption{\label{tab_3}Table 4 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{5} \par \begin{longtable}{P{0.689924670433145\textwidth}P{0.022410546139359697\textwidth}P{0.13766478342749527\textwidth}} ID\tabcellsep Manager's View\tabcellsep Security Personnel's View\\ \multicolumn{2}{l}{Emp0001 Forgets keycards}\tabcellsep Leaves items unattended\\ \multicolumn{2}{l}{Emp0002 Sociable, ambitious}\tabcellsep -\\ \multicolumn{2}{l}{Emp0003 Writes down passwords, leaves items unattended}\tabcellsep Forgets keycards\\ \multicolumn{2}{l}{Emp0004 Security conscious, ambitious}\tabcellsep -\\ \multicolumn{2}{l}{Emp0005 Sociable, lends keycards and PINs}\tabcellsep Forgets keycards\\ \multicolumn{2}{l}{Emp0006 Security conscious, understands and values ISM rules,}\tabcellsep -\\ \multicolumn{2}{l}{Emp0007 Lends keycards and PINs, does not value ISM rules}\tabcellsep -\\ \multicolumn{3}{l}{Emp0008 Lends keycards and PINs, does not understand or value ISM Lends keycards and PINs, writes down}\\ \multicolumn{2}{l}{Emp0009 Ambitious}\tabcellsep -\\ \multicolumn{2}{l}{Emp0010 -}\tabcellsep -\end{longtable} \par \caption{\label{tab_4}Table 5 :}\end{figure} \begin{figure}[htbp] \noindent\textbf{6} \par \begin{longtable}{P{0.6557142857142857\textwidth}P{0.19428571428571428\textwidth}} View\tabcellsep Profile\\ Cyber Activities\tabcellsep Easy hack target.\\ Background Information\tabcellsep \\ Manager's View\tabcellsep \\ Security Personnel's View\tabcellsep \end{longtable} \par \caption{\label{tab_5}Table 6 :}\end{figure} \backmatter \subsection[{E a r l y}]{E a r l y}\par V i e w \begin{bibitemlist}{1} \bibitem[Liu ()]{b6}\label{b6} ‘) a comparison of system call feature representations for insider threat detection’. A Liu . \textit{Proceedings of the 2005 IEEE Workshop on Information Assurance}, (the 2005 IEEE Workshop on Information AssuranceUnited States Military Academy, West Point, NY) 2005. \bibitem[Schneier ()]{b3}\label{b3} \textit{) the psychology of security}, B Schneier . 2008. (Online) \bibitem[Gonzalez and Sawicka]{b11}\label{b11} ‘2002) a framework for human factors in information security’. J J Gonzalez , A Sawicka . \textit{Proceedings of 2002 World Scientific and Engineering Academic Society International Conference on Information Security}, (2002 World Scientific and Engineering Academic Society International Conference on Information SecurityRio de Janeiro) \bibitem[Williams]{b4}\label{b4} ‘2011) do it differently’. B R Williams . \textit{Journal of Information Systems Security Association} 9 (5) p. 6. \bibitem[Mills ()]{b7}\label{b7} ‘A scenario-based approach to mitigating the insider threat’. R F Mills . \textit{Information Systems Security Association Journal} 2011. 9 (5) p. . \bibitem[Thompson ()]{b16}\label{b16} \textit{Available from: Emp0001 ?SF? Cannot determine personality Emp0002 IN?P Cannot determine personality Emp0003 ISFP Friendly, sensitive, likes own space and own time, loyal, committed, dislikes conflicts, enjoys present moment. Emp0004 INTP Seeks explanations, theoretical, not sociable, focused, analytical. Emp0005 ESFP Outgoing, friendly, accepting, loves material comforts, sociable, realistic, spontaneous. Emp0006 INTJ Develops perspectives, achieves goals, sceptical, has high performance standards. Emp0007 ESFP Outgoing, friendly, accepting, loves material comforts, sociable, realistic, spontaneous. Emp0008 ?SFP Cannot determine personality Emp0009 I??}, M Thompson . 2011. (P Cannot determine personality Emp0010 INTP Seeks explanations, theoretical, sociable, focused, analytical) \bibitem[Sabett ()]{b9}\label{b9} ‘Have you seen the latest and greatest "security game changer’. R V Sabett . \textit{Journal of Information Systems Security Association} 2011. 9 (5) p. 5. \bibitem[Bean ()]{b2}\label{b2} \textit{Human error at the centre of IT security breaches}, M Bean . \url{http://www.newhorizons.xom/elevate/network\%20defense\%20contributed\%20article.pdf} 2008. 2008. (Accessed 10 th February) \bibitem[Asai ()]{b0}\label{b0} \textit{Information security and business activities}, T Asai . 2007. Niigata, Japan: Kameda Book Service. \bibitem[Peltier ()]{b10}\label{b10} \textit{Information security policies, procedures and standards: guidelines for effective information security management}, T R Peltier . 2002. Boca Raton, FL: Auerback Publications. \bibitem[Vroom and Von Solms ()]{b8}\label{b8} ‘Information Security: Auditing the behaviour of the employee’. C Vroom , R Von Solms . \textit{IFIP TC11 18 th International Conference on Information Security (SEC2003)}, (Athens, Greece; Norwell, MA) 2003. Kluwer Academic Publishers. p. . (Gritzalis, D. et al. Security and Privacy in the Age of Uncertainty) \bibitem[Fernando and Yukawa (2013)]{b13}\label{b13} ‘Internal control of secure information and communication practices through detection of user behavioural patterns’. S A Fernando , T Yukawa . \textit{Proceedings of the World Congress on Engineering}, Lecture Notes in Engineering and Computer Science (the World Congress on EngineeringLondon) 2013. 2013. July 2013. p. . \bibitem[Foley ()]{b12}\label{b12} ‘Maintaining a proactive and sustainable security programme while hosting and processing personally identifiable information’. K Foley . \textit{Information Systems Security Association Journal} 2011. 9 (5) p. . \bibitem[Lacey ()]{b14}\label{b14} \textit{Managing the human factor in information security: how to win over staff and influence business}, D Lacey . 2009. West Sussex, England: Wiley. \bibitem[Young and Varano ()]{b15}\label{b15} \textit{Profiling pros and cons: an evaluation of contemporary criminal profiling methodologies. Final report -Honours Programme}, T M Young , S Varano . 2006. Boston, MA. Northeastern University \bibitem[Schweitzer ()]{b1}\label{b1} \textit{Protecting business information}, J A Schweitzer . 1996. Newton, MA: Butterworth-Heinemann. \bibitem[Lynch ()]{b5}\label{b5} \textit{Securing against insider attacks. Information Security and Risk Management}, D M Lynch . \url{http://www.csb.uncw.edu/people/ivancevichd/classes/MSA\%20516/Supplemental\%20Readings/Supplemental\%20Readi} 2006. p. . \end{bibitemlist} \end{document}