{"id":13409,"date":"2016-08-22T21:17:14","date_gmt":"2016-08-22T21:17:14","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2016\/08\/22\/closing-the-insider-threat-loop-with-authority\/"},"modified":"2026-08-08T04:29:54","modified_gmt":"2026-08-08T04:29:54","slug":"closing-the-insider-threat-loop-with-authority","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2016\/08\/22\/closing-the-insider-threat-loop-with-authority\/","title":{"rendered":"Closing the insider threat loop with authority"},"content":{"rendered":"\n

I’ve spent the past several months writing about building an effective and successful insider threat program. Over the last two months, we’ve looked at the topic through the lens of the three “As”: advocacy, agility, and authority. Since I’ve already covered advocacy and agility, it should come as no shock that this month’s blog focuses on the third “A”: authority.\u00a0In my experience, one of the most difficult hurdles to overcome when developing a program is convincing senior leaders to give proper authority to the head of the insider threat program. For a variety of reasons, leaders often withhold authority, wanting to keep the final say on actions to themselves. However, when the organization needs to take immediate action to respond to a threat, the extended chain of command leads to untimely or unnecessarily delayed responses. The result is confusion and failure.\u00a0 I can’t say enough about the frustration that occurs when you know which actions to take but can’t get hold of leadership to gain necessary approval to take that action. It gets even worse when multiple department heads have to agree before you can act. Inevitably, the decision is shuffled from one department head to another, waiting for consensus, while the problem escalates or even gets entirely out of control.Time wasted, in the case of insider threats, results in more data lost or damaged.Hamstringing the process<\/strong>The major problem is that, without authority, your response to any threat will not be agile or strong enough to stop or prevent the incident. Authority to act is an essential element of success. Conversely, lack of authority leads to confusion, disorganization, and failure.I have quoted Sun Tzu before, so pardon the repetition, but he has much to add to this discussion. “When the general is weak and without authority; when his orders are not clear and distinct; when there are no fixed duties assigned to officers and men, and the ranks are formed in a slovenly haphazard manner, the result is utter disorganization.” Cyber-adversaries don’t care how we are organized; in fact, they benefit when we are not. When any organization attempts to establish an insider threat program but does not give the necessary authority, Sun Tzu’s admonishment is in full effect. Responses to threats will be weak, unclear, and unresponsive, and will lead to failure.Laying out the requirements<\/strong>The National Insider Threat Task Force issued some basic rules for establishing effective insider threat programs. Three initial tasks were deemed as requirements:\u00a0<\/p>\n\n\n\n