Novel Insider Threat Techniques: Automation and Generation of Ad Hoc Digital Evidence

It is well-known that in today's information systems the vast majority of threats are coming from outside. In order to mitigate the effects of those threats several countermeasures have been proposed. Conversely, the same approach has not been adopted against insider threats, since such menaces come from the inside. Indeed, insiders are not considered enemies and so less attention have been focused on them. Also, what is worst is that who acts from the inside have remarkably more access rights to information if compared to the external attackers. In this work we show how to perform some actions on behalf of someone else that is unaware of the actions are being carried out. If those actions are illicit or illegal, this can become a serious problem that can result in the indictment of who will be considered responsible. Moreover, in order to validate our proposal, we consider the adoption of two different techniques. The first one is to automate as much as possible the actions to be performed by an insider. The second one is to prepare ad hoc digital evidence to thwart an investigation aimed at establishing the dynamics of the malicious activity. Clearly, the combination of these two techniques will amplify and magnify the effects of the nasty activity and will result also in a more difficult identification of the guilty party. Finally, this paper illustrates some typical scenarios where the proposed approach can be easily adopted and shows that recent technologies and devices can be more and more powerful tools in the hands of malicious insiders.