Insider Threat

By: Matthew Bun & Scott D. Sagan

Insider threats are possibly the scariest threat Security and Emergency Management professionals face, they are hard to identify and can cause catastrophic consequences. There are a lot of good case studies in this book on past insider threat incidents and the lessons learned with an emphasis on nuclear security. The emphasis is good for those of us who have responsibilities for nuclear facilities or materials but still beneficial for Emergency Managers who do not because every industry that has employees should be concerned about insider threats.  Insider threats can be a disgruntled current of former employee, coerced or threatened employee, ill intended contractor, or negligent systems operator. The fact that the threat can be anyone with authorized access to a facility or system makes it very difficult to identify. To further compound the issue how do we effectively identify and mitigate the threat while still maintaining a safe trusted work environment without employees feeling like “Big Brother” is watching? Should we keep our security personnel segregated from other employees to avoid developing personal biases (blinders) for potential threats, as is the policy for security personnel in Las Vegas? A see something say something policy with anonymous reporting has seemed to be effective as well as an engaging work environment where everyone feels connected and belonging. The truth is each organization is different, different objectives, different threat levels, different policies, and different cultures and require different, unique approaches to preventing and protecting against insider threats in a manner that protects employees and does not make the work environment scarry. This a challenging task, but it is achievable.

Warning, this is a bit of a dry read, not as fun as some of the other books we have read but delivers a lot of good information.

Take Aways

Insider threats are anywhere and waiting to strike where there is vulnerability. They know everything about your response measures and every route through your facility, this makes them dangerous and hard to predict.

Your best sensor for insider threats are the other employees around them, creating an environment where it is safe to report suspicious activity may help identify threats sooner.

Leadership engagement with employees to understand their beliefs, culture, and issues in and out of work may identify indicators of threats.