The Missing Link in Information Security: Three Dimensional Profiling

Abstract

The problem of information security has been combatted with the use of technological methods. However, the root of the problem is the behavior of human beings. Humans are stealing passwords, committing intellectual property crimes, skimming financial accounts, selling information to competitors, breaking into databases, cyber-snooping, and committing a host of other offenses against organizations and their systems. Ironically, the disciplines that assess, evaluate, and solve human based problems have not been an integral part of the information security measures used to protect data. The methodology of profiling has been used for two decades now to assist investigators and forensic analysts in criminal investigation. Profilers and forensic scientists have joined forces to enhance and expand the tool box used to investigate violent crimes. This same type of synthesis needs to occur between profilers and computer forensic experts. In addition to the needed synthesis between the computer scientists and the behavioral scientists, the classical methodology of profiling needs to be expanded. A multidimensional profiling method should be developed and used to specifically assess those who commit computer crimes and the causes behind the criminal behavior.