Fariborz Farahmand's guest appearances

Fariborz Farahmand

CERIAS Weekly Security Seminar - Purdue University

Ryan Henry

Cory Doctorow

Doug Smith

Larry Ponemon

George Heron

Laura Thomas

Eli Lilly

Stephen Elliott

Tony Sager

David Carroll

Jack Daniel

Joe Judge

Chris Reed

Richard III

John Richardson

OwlTail

There is considerable research being conducted on insider threats directed to developing new technologies. At the same time, existing technology is not being fully utilized because of non-technological issues that pertain to economics and the human dimension. Issues related to how insiders actually behave are critical to ensuring that the best technologies are meeting their intended purpose. In our research, we have investigated accepted models of perceptions of risk and characteristics unique to insider threat, and we have introduced ordinal scales to these models to measure insider perceptions of risk. We have also investigated decision theories, leading to a conclusion that prospect theory, developed by Tversky and Kahneman, may be used to describe the risk-taking behavior of insiders and can be accommodated in our model. Our results indicate that there is an inverse relationship between perceived risk and benefit by insiders and that their behavior cannot be explained well by the models that are based on the traditional methods of engineering risk analysis and expected utility. We discuss the results of validating that model with forty-two senior information security executives from a variety of organizations. We also discuss how the model may be used to identify characteristics of insiders' perceptions of risk and benefit, their risk-taking behavior and how to frame insider decisions. Finally, we recommend understanding risk of detection and creating a fair working environment to reduce the likelihood of committing criminal acts by insiders. About the speaker: Fariborz Farahmand received his Ph.D. in information and computer science from the Georgia Institute of Technology. He is a faculty fellow and a research assistant professor at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University. He has received several awards for excellence in scholarship and education, including a fellowship from the Institution for Information Infrastructure Protection (I3P). His research interests are in behavioral economics and its applications in information systems, security and privacy of information systems, vulnerability and risk assessment of information systems, and technology policy.  *For full review of this work please visit: Fariborz Farahmand, Eugene H. Spafford, "Understanding Insiders: An Analysis of Risk- Taking Behavior," Information SystemsFrontiers, Springer Publications, to appear 2011, 11 pages (Available online at: http://www.springerlink.com/content/t2g2836u1712474w/)

<p>There is considerable research being conducted on insider threats directed to developing new technologies. At the same time, existing technology is not being fully utilized because of non-technological issues that pertain to economics and the human dimension. Issues related to how insiders actually behave are critical to ensuring that the best technologies are meeting their intended purpose. In our research, we have investigated accepted models of perceptions of risk and characteristics unique to insider threat, and we have introduced ordinal scales to these models to measure insider perceptions of risk. We have also investigated decision theories, leading to a conclusion that prospect theory, developed by Tversky and Kahneman, may be used to describe the risk-taking behavior of insiders and can be accommodated in our model. Our results indicate that there is an inverse relationship between perceived risk and benefit by insiders and that their behavior cannot be explained well by the models that are based on the traditional methods of engineering risk analysis and expected utility. We discuss the results of validating that model with forty-two senior information security executives from a variety of organizations. We also discuss how the model may be used to identify characteristics of insiders' perceptions of risk and benefit, their risk-taking behavior and how to frame insider decisions. Finally, we recommend understanding risk of detection and creating a fair working environment to reduce the likelihood of committing criminal acts by insiders. About the speaker: Fariborz Farahmand received his Ph.D. in information and computer science from the Georgia Institute of Technology. He is a faculty fellow and a research assistant professor at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University. He has received several awards for excellence in scholarship and education, including a fellowship from the Institution for Information Infrastructure Protection (I3P). His research interests are in behavioral economics and its applications in information systems, security and privacy of information systems, vulnerability and risk assessment of information systems, and technology policy.  *For full review of this work please visit: Fariborz Farahmand, Eugene H. Spafford, "Understanding Insiders: An Analysis of Risk- Taking Behavior," Information SystemsFrontiers, Springer Publications, to appear 2011, 11 pages (Available online at: <a href="http://www.springerlink.com/content/t2g2836u1712474w/" rel="nofollow" target="_blank">http://www.springerlink.com/content/t2g2836u1712474w/</a>)</p>

Fariborz Farahmand, Understanding insiders: An analysis of risk-taking behavior *

Many companies today are paying attention to cloud computing and new aspects of large-scale, distributed computing. This emerging paradigm of the information age offers exciting benefits to companies and users, but cloud computing, like any other innovation, faces challenges such as security and privacy risks.  How do different stakeholders perceive these risks and the effectiveness of the mitigations? And, how are these reflected in their trust in the cloud? The answers to these questions can affect the outcome of policy debates, and the allocation of resources in controlling security issues of cloud environments.  This work presents an introduction to the cloud and some of its advantages and disadvantages. It discusses the role of risk perception and trust in security and privacy challenges of the cloud. It also makes recommendations addressing these challenges. About the speaker: Fariborz Farahmand received his Ph.D. in information and computer science from the Georgia Institute of Technology. He is a faculty fellow and a research assistant professor at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University. He has received several awards for excellence in scholarship and education, including a fellowship from the Institution for Information Infrastructure Protection (I3P). His research interests are in behavioral economics and its applications in information systems, security and privacy of information systems, vulnerability and risk assessment of information systems, and technology policy.

<p>Many companies today are paying attention to cloud computing and new aspects of large-scale, distributed computing. This emerging paradigm of the information age offers exciting benefits to companies and users, but cloud computing, like any other innovation, faces challenges such as security and privacy risks.  How do different stakeholders perceive these risks and the effectiveness of the mitigations? And, how are these reflected in their trust in the cloud? The answers to these questions can affect the outcome of policy debates, and the allocation of resources in controlling security issues of cloud environments.  This work presents an introduction to the cloud and some of its advantages and disadvantages. It discusses the role of risk perception and trust in security and privacy challenges of the cloud. It also makes recommendations addressing these challenges. About the speaker: Fariborz Farahmand received his Ph.D. in information and computer science from the Georgia Institute of Technology. He is a faculty fellow and a research assistant professor at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University. He has received several awards for excellence in scholarship and education, including a fellowship from the Institution for Information Infrastructure Protection (I3P). His research interests are in behavioral economics and its applications in information systems, security and privacy of information systems, vulnerability and risk assessment of information systems, and technology policy.</p>

Fariborz Farahmand, Risk Perception and Trust in Cloud