Over the past few months, I’ve written a lot about insider threats here. The term “insider threat” denotes someone who has access within an organization, while at the same time connotes a person who potentially causes harm to that organization. There are varying definitions for insider threats across government and commercial entities; however, for the purposes of our discussion, someone “inside” an organization who causes harm will be called an insider threat.
The real significance of the term “insider threat” to me is that we are talking about people and their actions. Insider threats are a people problem much more than a technology problem. No matter what vehicle is used to deliberately or unintentionally cause harm, a person is behind the activity. Too often, we forget this simple concept in how we execute counter-insider threat programs.<\/p>\n\n\n\n
Establishing policies, implementing processes and selecting appropriate technology all play a part in the overall defense against insider threats. Without advocacy, authority and agility, no counter-insider threat program will be successful. All of these factors must take into account that, at the core, we are dealing with the actions of people.<\/p>\n\n\n\n\n\n
Precisely because insider threat programs are about people, senior leaders, midlevel management and even employees have an innate (and I\u2019d say inordinate) distrust and avoidance reaction to them.<\/p>\n\n\n\n
Many of their concerns are valid, which is why we must design and implement insider threat programs with care and understanding. Of course all programs must consider privacy and civil liberties while at the same time protecting the organization\u2019s critical value data.<\/p>\n\n\n\n
In my experience, the best way to overcome these internal hurdles is through a large investment training and educating everyone at the organization. Only by spending significant energy on training and education are we able to ease the distrust toward counter-insider threat programs. It\u2019s imperative to highlight, in no uncertain terms, that the program is not “big brother” watching, but rather a well-meaning and thoughtful practice that protects and even empowers employees across the organization.<\/p>\n\n\n\n
Don\u2019t fall into a trap of thinking that if you have policies, processes and procedures in place that you can place training and education on the back burner. Being up front brings more referrals and support than you would believe, and a successful employee education program helps to strengthen all of the other measures that you employ.<\/p>\n\n\n\n\n\n
Another trap that insider threat practitioners fall into is only bringing bad news to the organization\u2019s leaders. I recall several instances when I would make appointments with senior leaders and they would sigh and say: “Now what?”<\/p>\n\n\n\n
I\u2019ll never forget one response from a particularly difficult leader when he informed me that he didn\u2019t want me bringing him any more bad news. “Can\u2019t you bring me some good news once in a while?” I learned the hard way that I had a responsibility to measure my communications. I knew I had valuable information to share, but it was my responsibility to temper the bad news with some positives every now and then.<\/p>\n\n\n\n
Most readers probably won\u2019t know the song, but famous band leader Phil Harris captures this concept perfectly in his song “The Thing” from 1950. It\u2019s a wonderful and fun example of a man who finds a box full of something important and valuable, but everyone he shows it to wants to stay away from it. No matter how hard he tries, nobody wants to see what\u2019s inside.<\/p>\n\n\n\n
As practitioners of insider threat programs, we often have information that is valuable, important and almost always negative. Nobody will want to see what\u2019s in our box if it\u2019s always full of trouble. In order to be successful in our jobs, we have to make them see, and that means bringing good news along with the bad.<\/p>\n\n\n\n
I am a very vocal advocate of the value that counter-insider threat programs offer to organizations, and I\u2019ve learned a great deal about establishing, running and overseeing successful programs. I also think it\u2019s critical to pass on these lessons so you can learn from my mistakes.<\/p>\n\n\n\n
Remember that insider threats are people problems\u00a0\u2014\u00a0people who create large amounts of negative data to fill\u00a0your “box” whether they mean to or not. Make sure that everyone in your organization understands what your program does and learn how to present more than just “what\u2019s in the box” to influence the decisions that your leadership group makes.<\/p>\n\n\n\n
Otherwise, you\u2019ll wind up like the man in Phil Harris\u2019 song:<\/p>\n\n\n\n
I wandered on for many years,
Keith\u00a0Lowry\u00a0is the\u00a0senior vice president of Nuix USG and Nuix’s Business Threat Intelligence and Analysis division<\/i><\/p>\n\n\n\n
.\u00a0He served as chief of staff to the deputy undersecretary of defense for human intelligence, counterintelligence and security at the Pentagon, and as an information security consultant in the private sector.<\/i><\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
As practitioners of insider threat programs, we often have information that is valuable, important and almost always negative. Nobody will want to see what\u2019s in our box if it\u2019s always full of trouble. <\/p>\n","protected":false},"author":7,"featured_media":37840,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[63,14,26],"tags":[],"coauthors":[1805],"class_list":["post-14812","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-it-networks","category-opinions"],"acf":{"subheadline":"","legacy_arc_id":"DIFOUX6VZJDKVDTBUAAJN2Z5ME","arc_canonical_url":"\/2016\/09\/13\/addressing-the-people-factor-in-insider-threats\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n