Resources

Be familiar with and stay current on relevant insider threat regulations, guidelines, laws, and directives (organizational, local, state, federal, international as appropriate/needed); examples include:

• Executive Order (EO) 13587
• National Insider Threat Policy and Minimum Standards
• NISPOM Change 2 (CFR Title 32, Part 117)
• National Institute of Standards and Technology (NIST)

Knowledge of and compliance with:

• Insider Threat Case Management process
• Reporting chain(s) for information sharing, dissemination, and escalation
• Insider Threat Program goals and objectives
• Concepts and terminologies (e.g., thresholds and priorities, Multi-disciplinary Insider Threat Working Groups, Potential Risk Indicators)

Complies with and stays current on relevant privacy and civil liberties protections; examples include:

• Ethics and Compliance Policies (e.g., retaliation and whistleblower act(s))
• Health Insurance Portability and Accountability Act (HIPAA)
• Equal Employment Opportunity (EEO)/Americans with Disabilities Act (ADA) compliant
• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Payment Card Industry Data Security Standard (PCI DSS)
• Federal Trade Commission (FTC) guidelines
• Federal Communications Commission (FCC) guidelines
• Sarbanes-Oxley Act (SOX)

Understands and complies with proper handling of sensitive information; examples include information related to:

• Privacy and civil liberties
• Protection of Personally Identifiable Information (PII)
• Information collection & storage limitations
• Protection of intellectual property and proprietary information (e.g., Non-Disclosure & Confidentiality Agreements)

Understands basic terms of reference, concepts, and principles related to the Counterintelligence Pillar to include:

• Foreign Intelligence Entity (FIE) collection priorities, tactics, techniques, and procedures
• Potential risk indicators (PRIs) (e.g., contact with foreign nationals, foreign visits, foreign travel, finances, elicitation, polygraph results)
• Capabilities, authorities, and jurisdictions of counterintelligence (CI) organizations and/or elements
• Reporting and escalation procedures

Identifies anomalous behaviors within the Counterintelligence Pillar and knows when and how to engage with relevant counterintelligence professionals who:

• Provide detailed risk and threat assessments
• Provide CI data in support of Insider threat assessments and mitigation

Understands basic terms of reference, concepts, and principles related to the Cyber Pillar to include:

• User activity monitoring (UAM) for data analysis
• UAM trigger development
• Users, privileged users, and trusted agents
• Potential risk indicators (PRIs) (e.g., unauthorized downloads, unauthorized access, sharing credentials, misuse of organizational systems and tools)
• Reporting and escalation procedures

Identifies anomalous behaviors within the Cyber Pillar and knows when and how to engage with relevant cyber professionals who:

• Provide enterprise audit monitoring, audit logs, profile data, printer log data, and download history
• Conduct long term analysis of UAM data
• Provide cyber data in support of Insider threat assessments and mitigation
• Identify users, privileged users, and trusted agents

Understands basic terms of reference, concepts, and principles related to the Human Resources Pillar to include:

• Basic employment records (e.g., disciplinary actions, performance reviews, transfer applications, awards information, timesheet data, leave approvals, corporate credit card data)
• Basic employee rights (e.g., EEO, ADA, FMLA, HIPAA)
• Potential risk indicators (PRIs) (e.g., changes in employee behavior and/or changes in employee performance, Equal Employment Opportunity issues, workplace complaints, lying about application information (i.e., resume))
• Reporting and escalation procedures

Identifies anomalous behaviors within the Human Resources Pillar and knows when and how to engage with relevant human resource professionals who:

• Provide human resources (HR) data in support of Insider threat assessments and mitigation
• Identify the field of work assigned to potential insider threat
• Identify minimum access potential insider threat needs to perform their job

Understands basic terms of reference, concepts, and principles related to the Law Enforcement Pillar to include:

• Public records (e.g., arrest records, court records, civil actions)
• Potential risk indicators (PRIs) (e.g., harassment, making threats, signs of extremism)
• Reporting and escalation procedures

Identifies anomalous behaviors within the Law Enforcement Pillar and knows when and how to engage with relevant law enforcement professionals who:

• Report and/or prevent suspected criminal activity
• Provide law enfocement (LE) data in support of Insider threat assessments and mitigation

Understands basic terms of reference, concepts, and principles related to the Legal Pillar to include:

• Potential risk indicators (PRIs) (e.g., NDA/confidentiality violations, misuse of company systems/resources, finance violations, ethical violations, data handling violations, sabotage of company systems, theft)
• Reporting and escalation procedures

Identifies anomalous behaviors within the Legal Pillar and knows when and how to engage with relevant legal professionals who:

• Provide legal data in support of Insider threat assessments, mitigation, and potential prosecution
• Provide guidance on legal requirements and boundaries

Understands basic terms of reference, concepts, and principles related to the social and behavioral sciences to include:

• Psychology of insider threat
• Critical path (e.g., predispositions, stressors, concerning behaviors, organizational responses to concerning behaviors)
• Basic behavioral models and psychological profiles to differentiate between normative behaviors vs. anomalous behaviors
• Potential risk indicators (PRIs) (e.g., access attributes; professional lifecycle and performance; foreign considerations; security and compliance incidents; technical activity; criminal, violent, or abusive conduct; financial considerations; substance abuse and addictive behaviors; judgment, character, and psychological conditions)
• Role of social and behavioral sciences (SBS) in production of Insider Threat products

Identifies anomalous behaviors within the Social and Behavioral Sciences pillar and knows when and how to engage with relevant behavioral science professionals who:

• Gain a general understanding of what is included and how to interpret mental health data found in workforce vetting forms
• Differentiate between behavioral considerations vs. health considerations
• Conduct real-time case reviews
• Case studies

Understands basic terms of reference, concepts, and principles related to the Security Pillar to include:

• Different types of security and security related policies (e.g., Personnel, Physical, Cyber, Information, Industrial, and Special Access Programs)
• Potential risk indicators (PRIs) (e.g., unauthorized access/entry, unauthorized disclosure/leak, other incident reports)
• Reporting and escalation procedures

Identifies anomalous behaviors within the Security Pillar and knows when and how to engage with relevant security professionals who:

• Provide security data in support of Insider threat assessments and mitigation
• Provide guidance on employee eligibility and access to sensitive/protected information
• Interpret background investigation and workforce vetting/suitability data

Conduct insider threat referral triage by compiling, reviewing, interpreting, correlating, and analyzing insider threat referral data in order to:

• Differentiate between false -positive indicators and true indicators that are potentially indicative of a threat
• Determine relevance, credibility, probability, magnitude (impact), and imminence of potential threat
• Identify known information gaps associated with potential threats
• Develop and recommend referral and analytic strategies
• Document triage activities detailing reasons for referral closure or escalation

Conduct timely, preventative, and relevant insider threat trend analysis in order to:

• Identify anomalous behavior/patterns of behavior indicative of an insider threat
• Identify new Potential Risk Indicators (PRIs) thresholds and referral guidance
• Provide direct support to senior leaders and stakeholders for organizational mitigation considerations

Understand collection capabilities and reporting cycles from the primary Pillars (e.g., CI, Security, Cyber, HR, SBS, LE) and use a multi-disciplinary approach to:

• Gather, integrate, and analyze threat-related information
• Leverage open-source intelligence as authorized by local, state, and/or federal regulations and organizational policies
• Aggregate and synthesize and place information in context
• Identify patterns and trends
• Present summary findings in support of insider threat assessments and mitigation

Develop threat/risk assessment(s) on a potential insider threat using a multi- disciplinary approach including concepts, principles, and standards related to:

• Potential insider threat indicators
• Research strategies for an insider threat inquiry
• Thresholds for reporting and action
• Aggregation and synthesis of all-source data
• Risk scores (risk = threat * impact * probability)

Support senior leaders, stakeholders, and mitigation activities by providing analytic assessments that incorporate:

• Analytic Standards for Analytic Products (e.g., Objective, Independent, Timely, Holistic, Descriptive)
• Intellectual Standards (e.g., clear, accurate, precise, relevant, in-depth, logical)
• Best practices and challenges of working with multi-disciplinary teams
• Strategies to prevent group polarization, group think, and/or artificial consensus

Exercise critical thinking and structured analytic techniques when conducting insider threat activities. Document analytic processes in a clear and understandable method. These techniques include but are not limited to:

• Hypotheses/scenario generation
• Alternative analysis techniques
• Argument mapping
• Bias elimination (e.g., confirmation, hindsight, foresight, availability, overconfidence)
• Occam’s Razor
• Diagnostic techniques (e.g., Key Assumptions, Quality of Information, Indicators or Signposts of Change, Analysis of Competing Hypothesis)
• Imaginative Thinking (e.g., Brainstorming, Outside-In Thinking, Red Team Analysis)
• Contrarian Techniques (e.g., Devil’s Advocacy, Team A/Team B, High Impact/Low Probability Analysis)

Understand how to access relevant databases/data feeds (e.g., local/national, government, and commercial) and understand the basic functions/capabilities of relevant dashboards and analytic tools in order to:

• Collect relevant insider threat related data
• Document and track potential insider-related events and actions
• Aggregate information and determine appropriate level of escalation
• Conduct trend analysis

Understand the mission, capabilities, and structure of the organization in order to:

• Support organizational leadership to identify key assets and vulnerabilities
• Identify key stakeholders within the organization and their roles in the insider threat process
• Create and/or participate in multi-disciplinary Insider Threat Working Groups (formal/informal and/or internal/external)
• Support your organization's Insider Threat program model (e.g., Point-to-Point vs. Hub-and-Spokes)

Understand procedures for determining an individual’s current level of risk based on the following factors:

• Placement and access (e.g., badges and credentials)
• Exposure (e.g., clearance levels, administrative privileges)
• Influence/seniority
• Historical disciplinary actions
• Performance reviews
• Pervasiveness of all factors

Understand how an insider threat or potential insider threat may be impacted (positively or negatively) by individual or organizational mitigation actions; considerations include:

• Where the individual falls along the critical pathway
• Predispositions, stressors, and concerning behaviors exhibited
• Previous organizational responses
• Available mitigation options (individual and organizational)

Understand and support the implementation of individual mitigation response options – CI, Cyber, HR, LE, Legal, SBS, and Security (e.g., administrative actions, performance counseling, remedial training, compliance mandate, performance improvement plan, employee assistance referral, access suspension and/or downgrades, suspension and/or termination of employment)

Monitor and assess the effectiveness and impact of chosen mitigation strategies and report findings to appropriate leaders and stakeholders

Understand how an insider threat or potential insider threat may be impacted (positively or negatively) by individual or organizational mitigation actions; considerations include:

• Where the individual falls along the critical pathway
• Predispositions, stressors, and concerning behaviors exhibited
• Previous organizational responses
• Available mitigation options (individual and organizational)

Understand and support the implementation of organizational mitigation response options – CI, Cyber, HR, LE, Legal, SBS, and Security (e.g., changes in policy, processes and procedures, and/or additional education/training/awareness)

Monitor and assess the effectiveness and impact of chosen mitigation strategies and report findings to appropriate leaders and stakeholders