Presentation from the University of South Wales at the Centre for Defence Enterprise Marketplace held on 5 February 2015. For more info see: https://www.gov.uk/government/news/mod-brings-businesses-together-for-innovative-defence-ideas

1. © University of South Wales
CDE35047
Securing Against the
Insider Threat: A NICHE
Approach to Host Based
Insider Threat Detection
Professor Andrew Blyth. PhD
Information Security Research Group
Faculty of Computing, Engineering and Mathematics, University of South Wales
T: +44 (0) 1443 482245 , E:andrew.blyth@southwales.ac.uk

2. © University of South Wales
The Conceptual Architecture
• Niche theory is the the modelling of
the behaviour governing a set of
roles/organisms within an
organisation/habitat.
– <Agent, Role, Action, Resource, Time>
• A role denes the division of labour
and takes the form of a series of
interactions between two roles. A role
always stands in a relationship with
another role and it is through this
relationship that interactions
• A role is both a descriptive and a
normative concept that can be used
to represent many divergent
organisational realities from the
structured to the unstructured.
2

3. © University of South Wales
The Technical Architecture
3
Process Resource
Role
Role Access
Engine (RAE)
Role Access
Profile (RAP)
Access Mode / Access Right
Imports to
define role
behaviour
Monitoring/Access Point
Detection
Module1
Detection
Modulen
Reporting
Engine (RE)Incident Reports
Imports to
define detection
capability
Imports to
define detection
capability