Risk Management without Threat Reports

The insider threat by the very concept is a difficult threat to face. As professionals operating in a National Industrial Security Program Operating Manual environment, we pay homage to these deviant but trusted employees without really addressing the issue. Of course we conduct the required insider threat program training, document it, and report the existence of our insider threat programs as required. In other words, it is easy to recognize the existence of the potential of an insider threat. We can even assign an impact level should we have an insider that goes to the dark side, but few can go beyond the recognition to implementing preventative measures.

What if you can’t identify a threat, do you still have a risk?

Insider threat programs and training requirements spend much effort on convincing that the insider threat is “real” and that if activated, they can cause a level of “damage” to national security, depending on the level of classified information exploited.  However, the mitigations are not well discussed. Many are looking for a level of threat assessment required prior to assigning a risk rating. It’s the old, Likelihood / Feasibility x Impact / Severity = risk (L x I =R or F x S =R) formula so often used. This is typically derived from an identified threat associated with the feasibility or likelihood part of the formula. However, the danger occurs with not having a smoking gun or specifically identified threat; which, we usually don’t. For example, if we don’t have any indication of employee x as going rogue, we have no threat report or adverse information on an employee, then we don’t have countermeasures to implement. In this case, well-meaning security managers may not see the need of applying countermeasures.

This is what the continuous evaluation process should expose. However, the logic would have you remove the threat that the evaluation process revealed. The truth may very well be, if you had a credible threat or report on your cleared employees, the mitigation would be to fire them or separate them from the classified work. Thus you get rid of the risk and no longer have a threat.

Let’s propose another way to perform risk management.

What if there was no smoking gun? What if you had no threat report? What’s the next step?

One solution is to assume a threat. Consider Manning and Snowden. Both are poster models for the insider threat; trusted cleared employees, one military and one contractor. Both performed their missions successfully and were probably rewarded for great work. However they exfiltrated classified information without anyone’s knowledge until the damage was done. By then it was too late.

Many who perform risk assessments absolutely capture the impact of how the insider can damage the mission of the organization as well as national security.  Without an actual threat report from a credible source, they are still able to consider that a threat may exist from the inside and assign a risk level. We can see this application of notional threat applied often with loss prevention disciplines in major corporations, banks, casinos, and stores. Even though most employees are honest and hardworking, some may be rogue. 

These risk managers are not tasked to identify which employees will go bad, they are only tasked with how to make it harder for rogue employees to steal. They employ mitigations such as audits, security cameras, anomaly searches and high tech solutions to catch thieves in the act.

How can this be applied by Security Managers?

Security managers can make it more difficult for an insider to sabotage a program or steal classified information using the following steps:

•        Determine what high value items exist: classified information, personal identifiable information, technical data, proprietary data, etc.
•       Determine where high value items exist: security container (s), location in building, in computers, in warehouse, etc.
•       Identify who has access to the high value items by name and location
•       Use technology or locking devices to prevent access to unauthorized persons: GSA Security container, high security locks, password protection, segregated networks, segregated computers and hard drives.
•       Control access to printers, faxes and computers. System administrators, ISSMs, ISSOs and others can use technology to limit downloads, print jobs, copying and etc. Technology can monitor and approve who conducts these tasks, time of day, and amount of data transferred.
•       Require permission to access high value items: An employee’s use of information technology should be treated as a privilege, approved, monitored, audited, by and authority and violations reported.

The traditional risk model includes identifying a threat. Many who use the traditional risk model find themselves inadequately protecting high value information because there has not been a history of adverse activity and they have not identified adverse activity from trusted employees. However a good risk assessment assumes that a threat exists, working to ensure authorized employees operate only as permitted. 

If you would like more information on insider threat training, just visit http://www.redbikepublishing.com/insiderthreat/

Jeffrey W. Bennett, ISP is the owner of Red Bike Publishing Red Bike Publishing . He regularly consults, presents security training, and recommends export compliance and intellectual property protection countermeasures. He is an accomplished writer of non-fiction books, novels and periodicals. Jeff is an expert in security and has written many security books including: "Insider's Guide to Security Clearances" and "DoD Security Clearances and Contracts Guidebook", "ISP Certification-The Industrial Security Professional Exam Manual", and NISPOM/FSO Training".