Employing Dynamic Models to Enhance Corporate IT Security Policy

Abstract

Since 9/11 and the creation of the U.S. Patriot Act, the intrusion of government surveillance into the lives of ordinary Americans has become a topic of great concern to many citizens. While many Americans view surveillance as a necessity in the name of national security, the government is not the only organization conducting surveillance. As technological capacity increases, an increasing number of employers are implementing technologies that allow them to maintain vigilance over the actions of their employees in the workplace. Despite many attempts to implement surveillance technologies, there is little evidence that companies are any safer now than they were ten years ago. This paper demonstrates how System Dynamics modeling can be utilized to help model the insider threat as a system. It provides analysis of the non-linear affect of decision making, assessing the 2nd, 3rd, and 4th order impacts of decisions, and demonstrates the important impact of delays in the system. A mathematical model is presented and simulations are conducted to determine the likely affect of company decisions and individual agent behavior.