Business Risk Analytics for Insider Threat Prevention in Data-Driven Organizations: An Entropy-Based Decision Framework
DOI:
https://doi.org/10.63646/SQDI7102Keywords:
Insider threat prevention; business risk analytics; entropy weighting; data-driven organizations; information security governance; risk decision frameworkAbstract
Insider-related incidents can undermine data-intensive organizations even when access originates from legitimate accounts and authorized workflows. Security teams must therefore decide where to intervene while distinguishing exposure from proof of misconduct and balancing protection, business continuity, employee privacy, and limited resources. This article develops a business risk analytics framework that combines workflow-level indicators with Shannon entropy weighting and a separate economic decision stage. Five indicators represent sensitive-data exposure, excessive access, outbound-control gaps, operational dependence, and detection or response gaps. Fixed reference scales preserve the interpretation of individual indicators, whereas entropy weights describe their dispersion across the workflows under comparison; they do not estimate incident probabilities or causal importance. A completely synthetic four-workflow illustration yields entropy weights of 0.182, 0.402, 0.080, 0.148, and 0.188, respectively, and ranks financial reporting, software delivery, customer analytics, and procurement from highest to lowest composite priority. Equal weights reverse the middle pair, and a plausible change in one synthetic input also reverses that pair. A separate hypothetical budget example shows how independently assumed avoided losses and implementation costs can inform control selection. These calculations establish arithmetic transparency but do not demonstrate detection accuracy, causal effectiveness, or financial returns in an operating organization. The framework adds explicit measurement rules, non-compensatory safeguards, uncertainty analysis, privacy protections, and a prospective validation protocol to entropy-based prioritization. It offers a transparent basis for managerial discussion while requiring empirical calibration and independent governance before operational use.
How to Cite
References
Al-Mhiqani, M. N., Ahmad, R., Zainal Abidin, Z., Yassin, W., Hassan, A., Abdulkareem, K. H., Ali, N. S., & Yunos, Z. (2020). A review of insider threat detection: Classification, machine learning techniques, datasets, open challenges, and recommendations. Applied Sciences, 10(15), 5208. https://doi.org/10.3390/app10155208
Alsowail, R. A., & Al-Shehari, T. (2021). A multi-tiered framework for insider threat prevention. Electronics, 10(9), 1005. https://doi.org/10.3390/electronics10091005
Axelsson, S. (2000). The base-rate fallacy and the difficulty of intrusion detection. ACM Transactions on Information and System Security, 3(3), 186–205. https://doi.org/10.1145/357830.357849
Baruwal Chhetri, M., Tariq, S., Singh, R., Jalalvand, F., Paris, C., & Nepal, S. (2024). Towards human-AI teaming to mitigate alert fatigue in security operations centres. ACM Transactions on Internet Technology, 24(3), 1–22. https://doi.org/10.1145/3670009
Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2010). Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness. MIS Quarterly, 34(3), 523–548. https://doi.org/10.2307/25750690
Cai, X., Wang, Y., Xu, S., Li, H., Zhang, Y., Liu, Z., & Yuan, X. (2024). LAN: Learning adaptive neighbors for real-time insider threat detection. IEEE Transactions on Information Forensics and Security, 19, 10157–10172. https://doi.org/10.1109/tifs.2024.3488527
Chatziamanetoglou, D., & Rantos, K. (2025). Weighted quality criteria for cyber threat intelligence: Assessment and prioritisation in the MISP data model. International Journal of Information Security, 24(4), 160. https://doi.org/10.1007/s10207-025-01080-6
Chen, Y., Ramamurthy, K., & Wen, K.-W. (2012). Organizations' information security policy compliance: Stick or carrot approach? Journal of Management Information Systems, 29(3), 157–188. https://doi.org/10.2753/mis0742-1222290305
Cram, W. A., Proudfoot, J. G., & D'Arcy, J. (2021). When enough is enough: Investigating the antecedents and consequences of information security fatigue. Information Systems Journal, 31(4), 521–549. https://doi.org/10.1111/isj.12319
Crossler, R. E., Johnston, A. C., Lowry, P. B., Hu, Q., Warkentin, M., & Baskerville, R. (2013). Future directions for behavioral information security research. Computers & Security, 32, 90–101. https://doi.org/10.1016/j.cose.2012.09.010
Dang-Pham, D., Thompson, N., Ahmad, A., & Maynard, S. (2025). Shadow information security practices in organizations: The role of information security transparency, overload, and psychological empowerment. Computers & Security, 156, 104538. https://doi.org/10.1016/j.cose.2025.104538
D'Arcy, J., Herath, T., & Shoss, M. K. (2014). Understanding employee responses to stressful information security requirements: A coping perspective. Journal of Management Information Systems, 31(2), 285–318. https://doi.org/10.2753/mis0742-1222310210
D'Arcy, J., Hovav, A., & Galletta, D. (2009). User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Information Systems Research, 20(1), 79–98. https://doi.org/10.1287/isre.1070.0160
Delso-Vicente, A.-T., Diaz-Marcos, L., Aguado-Tevar, O., & de Blanes-Sebastián, M. G. (2025). Factors influencing employee compliance with information security policies: A systematic literature review of behavioral and technological aspects in cybersecurity. Future Business Journal, 11(1), 28. https://doi.org/10.1186/s43093-025-00452-7
Erola, A., Agrafiotis, I., Goldsmith, M., & Creese, S. (2022). Insider-threat detection: Lessons from deploying the CITD tool in three multinational organisations. Journal of Information Security and Applications, 67, 103167. https://doi.org/10.1016/j.jisa.2022.103167
Fei, K., Zhou, J., Zhou, Y., Gu, X., Fan, H., Li, B., Wang, W., & Chen, Y. (2025). LaAeb: A comprehensive log-text analysis based approach for insider threat detection. Computers & Security, 148, 104126. https://doi.org/10.1016/j.cose.2024.104126
Fenz, S., & Ekelhart, A. (2011). Verification, validation, and evaluation in information security risk management. IEEE Security & Privacy Magazine, 9(2), 58–65. https://doi.org/10.1109/msp.2010.117
Ganin, A. A., Quach, P., Panwar, M., Collier, Z. A., Keisler, J. M., Marchese, D., & Linkov, I. (2020). Multicriteria decision framework for cybersecurity risk assessment and management. Risk Analysis, 40(1), 183–199. https://doi.org/10.1111/risa.12891
Gheyas, I. A., & Abdallah, A. E. (2016). Detection and prediction of insider threats to cyber security: A systematic literature review and meta-analysis. Big Data Analytics, 1(1), 6. https://doi.org/10.1186/s41044-016-0006-0
Gong, Y., Cui, S., Liu, S., Jiang, B., Dong, C., & Lu, Z. (2024). Graph-based insider threat detection: A survey. Computer Networks, 254, 110757. https://doi.org/10.1016/j.comnet.2024.110757
Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438–457. https://doi.org/10.1145/581271.581274
Herath, T., & Rao, H. R. (2009). Encouraging information security behaviors in organizations: Role of penalties, pressures and perceived effectiveness. Decision Support Systems, 47(2), 154–165. https://doi.org/10.1016/j.dss.2009.02.005
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2020). Insight into insiders and IT: A survey of insider threat taxonomies, analysis, modeling, and countermeasures. ACM Computing Surveys, 52(2), 30. https://doi.org/10.1145/3303771
Hu, Q., Dinev, T., Hart, P., & Cooke, D. (2012). Managing employee compliance with information security policies: The critical role of top management and organizational culture. Decision Sciences, 43(4), 615–660. https://doi.org/10.1111/j.1540-5915.2012.00361.x
Inayat, U., Farzan, M., Mahmood, S., Zia, M. F., Hussain, S., & Pallonetto, F. (2024). Insider threat mitigation: Systematic literature review. Ain Shams Engineering Journal, 15(12), 103068. https://doi.org/10.1016/j.asej.2024.103068
Jalalvand, F., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert prioritisation in security operations centres: A systematic survey on criteria and methods. ACM Computing Surveys, 57(2), 42. https://doi.org/10.1145/3695462
Kehr, F., Kowatsch, T., Wentzel, D., & Fleisch, E. (2015). Blissfully ignorant: The effects of general privacy concerns, general institutional trust, and affect in the privacy calculus. Information Systems Journal, 25(6), 607–635. https://doi.org/10.1111/isj.12062
Khan, N., Houghton, R. J., & Sharples, S. (2022). Understanding factors that influence unintentional insider threat: A framework to counteract unintentional risks. Cognition, Technology & Work, 24(3), 393–421. https://doi.org/10.1007/s10111-021-00690-z
Li, X., Li, L., Li, X., Cai, B., Jia, J., Gao, Y., & Yu, S. (2024). GMFITD: Graph meta-learning for effective few-shot insider threat detection. IEEE Transactions on Information Forensics and Security, 19, 7161–7175. https://doi.org/10.1109/tifs.2024.3430106
Liu, L., De Vel, O., Han, Q.-L., Zhang, J., & Xiang, Y. (2018). Detecting and preventing cyber insider threats: A survey. IEEE Communications Surveys & Tutorials, 20(2), 1397–1417. https://doi.org/10.1109/comst.2018.2800740
Lo, C.-C., & Chen, W.-J. (2012). A hybrid information security risk assessment procedure considering interdependences between controls. Expert Systems with Applications, 39(1), 247–257. https://doi.org/10.1016/j.eswa.2011.07.015
Maček, D., Magdalenić, I., & Ređep, N. (2020). A systematic literature review on the application of multicriteria decision making methods for information security risk assessment. International Journal of Safety and Security Engineering, 10(2), 161–174. https://doi.org/10.18280/ijsse.100202
Menard, P., Bott, G. J., & Crossler, R. E. (2017). User motivations in protecting information security: Protection motivation theory versus self-determination theory. Journal of Management Information Systems, 34(4), 1203–1230. https://doi.org/10.1080/07421222.2017.1394083
Ou Yang, Y.-P., Shieh, H.-M., & Tzeng, G.-H. (2013). A VIKOR technique based on DEMATEL and ANP for information security risk control assessment. Information Sciences, 232, 482–500. https://doi.org/10.1016/j.ins.2011.09.012
Parsons, K., Calic, D., Pattinson, M., Butavicius, M., McCormac, A., & Zwaans, T. (2017). The human aspects of information security questionnaire (HAIS-Q): Two further validation studies. Computers & Security, 66, 40–51. https://doi.org/10.1016/j.cose.2017.01.004
Pathirana, N., Roberts, R., Kalutarage, H., & McDermott, C. D. (2026). Integrating human factors into insider threat detection – a systematic review. ACM Computing Surveys, 58(10), 260. https://doi.org/10.1145/3798089
Roszkowska, E. (2026). Entropy and normalization in MCDA: A data-driven perspective on ranking stability. Entropy, 28(1), 114. https://doi.org/10.3390/e28010114
Roy, K. C., & Chen, G. (2024). GraphCH: A deep framework for assessing cyber-human aspects in insider threat detection. IEEE Transactions on Dependable and Secure Computing, 21(5), 4495–4509. https://doi.org/10.1109/tdsc.2024.3353929
Saeed Alketbi, K., & Mehmood, A. (2025). A comprehensive survey of explainable artificial intelligence techniques for malicious insider threat detection. IEEE Access, 13, 121772–121798. https://doi.org/10.1109/access.2025.3587114
Saito, T., & Rehmsmeier, M. (2015). The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. PLOS ONE, 10(3), e0118432. https://doi.org/10.1371/journal.pone.0118432
Shameli-Sendi, A., Aghababaei-Barzegar, R., & Cheriet, M. (2016). Taxonomy of information security risk assessment (ISRA). Computers & Security, 57, 14–30. https://doi.org/10.1016/j.cose.2015.11.001
Shannon, C. E. (1948). A mathematical theory of communication. Bell System Technical Journal, 27(3), 379–423. https://doi.org/10.1002/j.1538-7305.1948.tb01338.x
Sohrabi Safa, N., Von Solms, R., & Furnell, S. (2016). Information security policy compliance model in organizations. Computers & Security, 56, 70–82. https://doi.org/10.1016/j.cose.2015.10.006
Trang, S., & Nastjuk, I. (2021). Examining the role of stress and information security policy design in information security compliance behaviour: An experimental study of in-task behaviour. Computers & Security, 104, 102222. https://doi.org/10.1016/j.cose.2021.102222
Zhu, Y., Tian, D., & Yan, F. (2020). Effectiveness of entropy weight method in decision-making. Mathematical Problems in Engineering, 2020, 3564835. https://doi.org/10.1155/2020/3564835
