Advanced Personnel Vetting Techniques in Critical Multi-Tennant Hosted Computing Environments

TL;DR

This paper investigates insider threats in cloud security for critical infrastructures, proposing proactive socio-technical solutions including employee screening with cognitive analysis and ethical guidelines to enhance security without infringing on human rights.

Contribution

It introduces a comprehensive framework and novel assessment methods, such as fMRI-based screening, to improve insider threat detection in cloud environments for sensitive infrastructures.

Findings

Proposed actionable security practices for insider threat mitigation.

Evaluated cognitive analysis techniques like fMRI for employee screening.

Presented ethical guidelines balancing security and human rights.

Abstract

The emergence of cloud computing presents a strategic direction for critical infrastructures and promises to have far-reaching effects on their systems and networks to deliver better outcomes to the nations at a lower cost. However, when considering cloud computing, government entities must address a host of security issues (such as malicious insiders) beyond those of service cost and flexibility. The scope and objective of this paper is to analyze, evaluate and investigate the insider threat in cloud security in sensitive infrastructures as well as to propose two proactive socio-technical solutions for securing commercial and governmental cloud infrastructures. Firstly, it proposes actionable framework, techniques and practices in order to ensure that such disruptions through human threats are infrequent, of minimal duration, manageable, and cause the least damage possible. Secondly, it aims for extreme security measures to analyze and evaluate human threats related assessment methods for employee screening in certain high-risk situations using cognitive analysis technology, in particular functional magnetic Resonance Imaging (fMRI). The significance of this research is also to counter human rights and ethical dilemmas by presenting a set of ethical and professional guidelines. The main objective of this work is to analyze related risks, identify countermeasures and present recommendations to develop a security awareness culture that will allow cloud providers to utilize effectively the benefits of this advanced techniques without sacrificing system security.