Establish an Insider Threat Program

Jeff is available for speaking and consulting

https://jeffreywbennett.com
https://jeffreywbennett.thinkific.com

FSOs have a huge responsibility to protect contractor information. One important job is to start with an insider threat program.

Most people make the mistake of relying on tracking employees and looking for suspicious behavior. That's not a good way to start.

I've got a better solution. It's here in the video as well as my new book:

Establish an Insider threat program under NISPOM. https://www.redbikepublishing.com/books/
https://www.redbikepublishing.com/insiderthreatprogram/

Online security clearance webinars and coaching. Providing security training and resources.


It also answers the question that so many people have asked,

• If we have the NISPOM, why do we need an insider threat program?
• If the NISPOM is so thorough, what would an additional insider threat program look like?

Most organizations attack the problem with either an employee tracking or online activity reporting goal.

After asking the above questions, we recommend a different solution. Of course the employee reporting and activity tracking solutions are important and part of the solution, but they should not be the end goal.

This book recommends a different application that can easily be implemented to both resolve insider threat issues and demonstrate compliance.

Establishing an Insider Threat Program Under NISPOM is written primarily for cleared defense contractors to meet Insider Threat Program requirements under the cognizance of the U.S. Government (Defense Counterintelligence and Security Agency (DCSA)).

Our recommended approach and practices help reduce vulnerabilities without negatively impacting the work force. You will learn to be innovative in your approach as well as leverage industry best practices for a more effective ITP. These solutions incorporate a systems-based approach that meets the following criteria:

• Document what needs to be protected
• Establish countermeasures to limit access
• Meet reporting requirements for unauthorized access
• Train the workforce

This book provides tools and templates that you can use immediately to document your progress and demonstrate program during reviews.

Jeff's Website
Jeff is available for speaking and consulting

Clearance, NISPOM, and FSO Consulting
Thrive Analysis Group Inc is your resource for security clearance, NISPOM, and FSO consulting.

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:00

Welcome to DOD Secure, and I'm your host, Jake track back in because it was so much fun, and I hope you don't find it annoying. I hope it pumps you up for a very important discussion that we're going to have in this podcast. Hello everybody. I'm Jeff Bennett, and I'm the author of many, as you know, NISPOM-based books, the National Industrial Security Program Operating Manual. And today I want to talk to you about starting your insider threat program. So welcome to our podcast. And we will begin with the discussion of the insider threat program. And specifically, I'm going to talk to you who are facility security officers, sorry, insider threat program, senior officials. And it's based on the content of this book that I've just written and some training that I'm putting together that's available for you. It's called Establish an Insider Threat Program under NISPOM. And as the subtitle says, this is for the ITPSO, the FSO, and National Industrial Security Program contractors and what you need to know. Again, this is setting up an insider threat program under the NISPPOM. So it's very specific to a certain few of you who are working in clear defense contractors. And I think this is a very important topic. When I began writing the book, I asked the question: if we have NISPPOM and we have guidance, why do we need an insider threat program? Why all of the emphasis on an insider threat program if we have the NISPPOM? And many of you know that if you work in this space, facility security officers and their security specialist or industrial security specialists understand exactly what they need to do under the NISPPOM. Some people call it a safe. You have specified um means of, or rather, they're approved for the storage of classified information. You have special locks on them, combination locks. Additionally, um, you have approved secure areas where you should be working on it. And defense contractors are built with alarms, access controls, uh, fortified buildings, fortified rooms, you name it, they're all there. Again, with all this protection, why do we really need an insider threat program? Well, I'll tell you why. We've got to protect our classified information a bit better. As you may notice, I talked about fortified buildings, barriers, guards, guns, alarms. NISPOM covers the wide range of how to protect classified information as physical items, as documents, and as um information or software on computing devices, um information systems, right? So they have to be approved. Again, great information and great way to secure that information, but who's it secured against? Right? It's secured against people trying to break in, unauthorized intruders, right? All the way down to locking everything up. But what about those people who have the alarm codes, access passwords, pen numbers, biometrics, they can get into the safes, they are authorized to work on these products. How do we set up a program to protect classified information from these trusted employees? Well, the answer is with that insider threat program. But not everybody is focused on while they put together these insider threat programs, they're not really focused on protecting this classified information. They're focused on applying two prominent countermeasures as their solution for protecting the insiders of protecting against insider threat. These are often referred to as um employee uh monitoring employee activity on computers, as well as reporting requirements as found in NISPPOM. And I'm going to hit on those specifically why they are a good idea to use, but a bad idea to rely on for detecting that insider threat. So let's hit specifically the first topic of monitoring employee activity. So, under the NISPPOM, as I mentioned earlier, there are great countermeasures that help prevent outsiders from breaking into clear defense contractor locations. And NISPOM lists those countermeasures again, which include alarms and locks and um access control. Again, these do a great job of keeping people, external people outside of the organization. But there are also other requirements that came before the insider threat program came about. And these requirements are based on the 13 adjudicative criteria. And if you go back, if you're unfamiliar with this and you go back into my security clearance uh discussions on this podcast, you can remember or you may recall that we talked about those 13 adjudicative criteria including that include um topics under foreign control, foreign influence, foreign relations, legal problems, um, some counseling, uh, financial issues. And so there are again 13 items that we should be reporting. And there are reporting requirements, according to NISPOM, that should be uh provided to the facility security officer. Reporting requirements include items that will uh make classified information more vulnerable or show a lack of ability to protect classified information. So these reporting requirements also include things that may affect an individual's ability to protect classified information, as well as a facility's ability to protect classified information according to NISPOM. But again, there are those reporting requirements that should be leveraged. But my argument is that any one of these 13 adjudicative criteria topics may not necessarily indicate an insider threat. Again, they're broad general topics that may highlight a behavior and highlight a potential concern, but reporting on these may not um indicate an insider threat, may indicate somebody's unable to uh uh properly make wise decisions as far as their personal lives. For example, if somebody is arrested for drunk driving, does not mean that they are going to commit espionage or sabotage. So they're better things to look for. Again, these reporting requirements are necessary, they should be conducted. However, relying solely on these reporting requirements, as some do, um, is not the answer. It's not the complete answer, it's part of it. And I'll give you another example. Uh, some of my fellow FSOs in describing their insider threat program, uh, some of them do use matrices to capture employee behavior, and that's what they spend a lot of time discussing in their um insider threat program meetings. They discuss the 13 criteria and discuss who may be um providing indicators of being of committing violations under those 13. So eventually they could have these discussions month in, month out, year in, year out, and never really determine if they have an insider threat when they could be losing um classified information under their nose. So there is a better indicator. Again, um, this reporting is necessary, it is required, and by all means do it. But it should only be a part of your insider threat program. All right, I would like to tell you now, give you a special message from SIMS Software, S-I-M as a Mike S Software. As Clear Defense contractors, you represent the backbone of innovation, the front line of our national security and protectors of all that we hold dear. SIMS Software is proud to be your ally in these endeavors. As most trusted name in industrial security information management for over 38 years, SIM Software equips you with the tools to protect the lifeblood of your organization. Our flagship Sims Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more.com or call 858-481-9292 or see our show notes for more information. Now, the other issue that I find problematic and may not be addressing the insider threat is monitoring an employee's online activity. Now, there's software that helps you monitor your employees' online activity. And again, this software could indicate that you have an insider threat issue as far as bringing vulnerabilities. Um, you may be able to determine whether somebody's trying to exfiltrate information. And so I consider this a less effective way in the NISP arena. Again, um, I wrote that book called Insider Threat Program under the NISPOM, meaning what is the susceptibility of classified information to be exploited by an insider? So monitoring uh an employee's online activity or unclassified network activity may not really indicate an insider threat as far as classified information is concerned. And so that just needs to be tweaked a little bit. And I'll give some recommendations in another podcast. But right now, um, if an organization is relying solely on this or the other countermeasure of monitoring employee activity, um, it may not be enough. But I will provide recommendations on what you can do to recognize red flags. Again, um, by all means, if you need to monitor employee activities, please do so. Um, what I'm proposing is a way to implement your insider threat program without making your employees paranoid and without having to rely on these measures. While the NISPPOM and DOD recommends implementing an insider threat program, they're less than committal on how to do it. For example, yeah, you may need to consult lawyers, ethics advisors, as well as human resources. So that tells you there may be a problem at the get-go if you are using these types of countermeasures. The countermeasures I'm recommending will not will not raise red flags with legal and um ethics or human resources uh disciplines. So please stay tuned as we discuss those in further podcasts. So, in summary for this podcast, I'd like you to be aware of that there are insider threat program requirements for protecting classified information. That's what this book, or that's why this podcast is primarily focused on. It requires more um countermeasures and more in-depth and uh countermeasures than are typically practiced in our field. And again, those countermeasures are monitoring employee activity and reporting behavioral issues. And right now, the guidance again is general and it's a guidance provided with warning that you need that you should consult um legal uh or obtain legal advice, obtain advice from ethics professionals as well as human resources professionals. Additionally, um, some training also asks that uh defense contractors and government officials obtain the services of behavioral analysts to determine uh or dictate employee behavior activity based on their personalities or other types of studies. Again, I don't recommend spying on your employees. I recommend putting up trips and raising red flags and responding properly. So, for the um insider threat, here are some things I recommend that I'll be speaking more in depth. First of all, before you can employ information assurance or information security or even cybersecurity, need to understand specifically what needs to be protected. After you determine what needs to be protected, you need to determine who needs to access that information. Once you do that, you can start putting countermeasures in place that are based on this these access requirements. So that if an authorized person who can come in and is authorized to turn off alarms, unlock safes, and access classified information, or if you're a non-NISPOM contractor or a non-government entity, you can still apply these methodologies to determine who the insider threat might be. And so we recommend identifying what needs to be being protected, limiting access to that protection. For example, you know, NISPOM requires that secret information be stored in a GSA-approved container. Well, you can make sure that only people with classified, oh, with a secret clearance can access that container. However, you may have all kinds of uh secret information locked up in that same container that not everybody needs to access. So how are you going to limit that access? Another example would be like, for example, a non-government or a nonprofit organization, maybe a church or a volunteer organization where financial information is stored or even personal information of your members. And the further, you know, we need to figure out how to seg identify what is sensitive and segregate it. For example, when I taught the churches, you might have a large church, may have a large pastoral staff, which includes um an executive pastor, a senior pastor, a youth pastor, a children's pastor, a maintenance pastor, etc. Some of these organizations are quite large. So in this example, maybe there are different types of therapy going on or counseling situations that not every single pastor needs information about the counseling that another pastor is doing. So, how do you identify that and how do you segregate that from everybody accessing it for businesses, maybe sales organizations? The issue might be employees knowing sales statistics or having access to um referral databases or access to um intellectual property or other company uh material that needs to be protected. Not every employee needs information about the financials, not every employee needs information about the customer base. So, in all of these situations, how can you protect, identify that information that needs to be protected? How do you segregate it? And how do you allow access to that information to the people who need access to that information? And if somebody is trying to gain some authorized employees trying to gain unauthorized access to information, what are the red flags you want to raise and what are the triggers that might trip some concern that you should take uh that you may need to take to? What triggers are in place that indicate an insider is using information in an unauthorized manner? And what do you do about it? And so so for future discussions, we'll continue this topic. And especially here's a good example. Um, how do you limit access? And what how do you define need to know? And what will you do if um somebody tries to get information that they have no need to know of, or have no need of knowing, or no need of access? Once again, I thank you for joining DOD Secure. This is your place to go for all things that all things security clearly coming back for another episode. We need to find more resources. We are here to help you, you know, you will find those resources. We actually perform Nisp test and as well as FSO or Nispong Consulting in case you have that need. Wish you all the best, and we'll see you next time.