Beyond Access Control: Predicting Insider Threats through Social Media and BPM
Insider Threat: Enhancing BPM through Social Media
The paper proposes a novel Business Process Management (BPM) monitoring framework that integrates psychometric evaluations from Social Media to mitigate insider threats. By combining Open Source Intelligence (OSINT) with traditional organizational monitoring, the authors aim to identify predisposing delinquent behaviors in employees occupying critical roles.
TL;DR
This research introduces a monitoring model that enhances Business Process Management (BPM) by integrating psychometric evaluations extracted from social media. It moves beyond traditional technical safeguards (like firewalls or RBAC) to address the "human factor," effectively using OSINT to predict potentially malicious behavior by insiders before an incident occurs.
Problem & Motivation: The "Invisible" Insider
In modern enterprises, Business Process Modeling has reached a high level of maturity. However, a significant gap remains: Security is often treated as a structural property rather than a behavioral one.
Traditional security requirements—Authorization, Authentication, and Auditing—assume that if a user is "authorized," they are "trusted." Inside threats prove this assumption false. The authors argue that current BPM tools are blind to the psychological shifts (motives, frustrations, or radicalization) that lead an employee to sabotage a system or steal data. The challenge lies in objectively measuring these "human" variables without purely relying on intrusive workplace surveillance.
Methodology: Fusing OSINT with BPM
The core innovation is the integration of Open Source Intelligence (OSINT) into the BPM lifecycle. The proposed architecture functions on three distinct input streams:
- Business Monitoring Data: Performance metrics and logs from internal systems (ERP, etc.).
- Online Monitoring: Behavioral traits harvested from social media (Twitter, YouTube, blogs).
- Process Context: Mapping which users hold "critical roles" within the organizational workflow.
The Architecture of Oversight
The system identifies specific psychosocial traits—such as narcissism, divided loyalty, and predisposition towards law enforcement—which academic research has linked to insider delinquency.
Fig 1: The proposed architecture showing the fusion of online monitoring and internal business logs.
By correlating a user's online "digital persona" with their offline "work performance," the system generates potential incident alerts. This allows security operators to focus on individuals who exhibit both a high-risk psychological profile and a decline in workplace performance.
Experiments & Results: The Power of Public Data
The authors emphasize that this monitoring does not require hacking or intrusive network sniffing. Because many users neglect privacy settings, their public footprints provide a wealth of data for behavioral analysis.
Key Indicators of Risk
The paper categorizes risk through two lenses:
- Asset Risk: The sensitivity of the data/process the employee handles.
- Human Risk: The predisposing delinquent behavior identified via OSINT.
Fig 2: Specific psychological traits targeted for detection in the digital sphere.
The study highlights that by using OSINT techniques (Fig 3), organizations can uncover data locations and refine results to focus on intelligence that indicates a shift from a "trusted employee" to a "potential threat."
Fig 3: The OSINT workflow for gathering publicly available employee data.
Critical Analysis: The Privacy Paradox
While the technical capability to predict threats is high, the authors provide a necessary ethical warning.
Monitoring employees outside the "traditional work sphere" has a "chilling effect" on freedom of speech and personality. The paper notes a sharp divergence between US and European law:
- US Perspective: Often views workplace privacy as an exchange for employment.
- European Perspective: Upholds the "right to dignity" that does not stop at the employer's doorstep.
Final Takeaway
The authors conclude that while this system is technically powerful, it should only be deployed in Critical Infrastructures (energy, national security, finance) where the potential damage to society outweighs the individual's right to total digital anonymity.
Future Work
The roadmap includes developing more robust implementation techniques for risk analysis and refining the legal framework to ensure that "proactive detection" does not devolve into "unjustified discrimination."