Establish an Insider Threat Program Under NISPOM Interview

This is a collaborative effort with Clearancejobs.com and an interview from my newest book, Establish and Insider Threat Program Under NISPOM

FSOs have a huge responsibility to protect contractor information. One important job is to start with an insider threat program.

Most people make the mistake of relying on tracking employees and looking for suspicious behavior. That's not a good way to start.

I've got a better solution. It's here in the video as well as my new book:

Establish an Insider threat program under NISPOM. Tools, templates and procedures you can download.
https://www.redbikepublishing.com/insiderthreatprogram/

Jeff is available for speaking and consulting
https://jeffreywbennett.com


Online security clearance webinars and coaching. Providing security training and resources.
https://jeffreywbennett.thinkific.com

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Clearance, NISPOM, and FSO Consulting
Thrive Analysis Group Inc is your resource for security clearance, NISPOM, and FSO consulting.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_01 0:06

Welcome to DOD Secure, and I'm your host, Jeff.

SPEAKER_00 0:17

Hi, this is Kaiser with ClearanceJobs.com. Thank you so much for joining us for the interview today. I'm really excited for today's interview. We actually set this up. I can't remember, um, Jeffrey, when when you reached out to me about your newest book. I mean, we've read all of your books over here at Clearance Jobs, but it was very timely with Insider Threat being in the news. So you have a new book, Establish an Insider Threat Program under the NISPPOM. And Jeff Bennett is here to chat with us today about it. He's a security expert. Know him from his army background, but he's also worked within the government and a number of major clear defense contractors, providing a lot of expertise and insight across the security field. So I really appreciate your taking the time to chat with me today. Jeff.

SPEAKER_01 1:00

Thank you. It's great to be here for the second time. I appreciate Lindy, your support of my books and the opportunity to interview with you.

SPEAKER_00 1:08

I love it. So it's establishing an insider threat program under the NISPOM. So this has been a requirement that's been baked into policy for a while now. Um, but we see it ever evolving, ever changing. Why is it this book? Why now? And why is this kind of an important read for folks who might be operating under the NISPPOM?

SPEAKER_01 1:29

Okay. Yeah, thank you for an opportunity to explain that. Um well I I built I started writing the book wondering, you know, how do we establish this uh insider threat program and why should we if we have the NISPOM in place? I mean, it's a good authoritative guideline on how we protect classified information. And so I started interviewing FSOs and asking them, how are they interpreting the requirement for an insider threat program? And um I started taking online training through all the resources and going to briefings, and I started uh noticing a common theme, and that is a lot of the training and the FSOs are focusing on the 13 adjudicated criteria. Um, those are very important. I'm not saying don't use it, I'm saying uh in my thesis here that you should leverage it but not lead in with it, because a lot of times this training that I've taken um suggests that if you do use that, you need to consult with legal and with ethics so that you don't violate your employee rights. But um the focus that I chose is to focus on the information and not the employees. You you may have issues with employees, and but the 13 aged criteria are really good at determining um risk to classified information or determining risk to that classified information from the vetted employee. However, um most of those countermeasures or most of those criteria can't be used to determine who your insider threat might be. For example, you know, I might get continuous DUIs or I might have uh drug issues, but it doesn't mean I'm gonna spy and steal your information. You should definitely fire me and get rid of me. But if I can't perform accordingly, or if I'm using my computer for um gambling or for um checking my stocks all the time, right? If I'm not working properly, that's a behavioral issue, not an espionage issue. And so I wanted to give the um employees, uh, the FSOs or security specialists, an opportunity or permission to just focus on the information, the other stuff will fall out. And um, so to answer the question, why, if we have the NISPPOM, do we need an insider threat program? Well, the NISPOM and DOD guidance as well will have you um build a facility that protects classified information from the outsider. You know, our families can't get in unless they have permission. We have cleared employees with badges that can get in. But uh when was the last time we've heard of somebody breaking into a defense contractor or a government facility and walking out with a secret? Um trusted employees are walking out with those secrets and providing it on the internet or to their handlers.

SPEAKER_00 4:28

Okay, so that's a that's an interesting way to look at it. I love how you're talking about the information and not necessarily the individual. So kind of talk about um how you came, you know, how you came to that approach and why looking at information is uh is a better launching point for organizations.

SPEAKER_01 4:44

Okay, sure. Um I think I mentioned to you earlier, if I were writing this book for, and I probably will rewrite this book for um commercial entities, for nonprofit organizations, churches, and things, I would call it an information protection program. Um, a lot of times I work with a lot of scientists, researchers, designers, and builders in my career. Um, usually what happens is the government will put out a contract for engineering services, and the contractor will build a weapon system or a capability or provide services under that contract. Um, and they'll put out what might or might not be classified. They might even give you some government fund government information that you should protect. And the FSOs and security specialists do that really well. But keeping in mind that they are staff officers in many cases. Sometimes, if you're small enough, you're the FSO CEO, engineer, and everything in your company. But if you're a staff officer, sometimes you have good access to that information the government provides. Um, and you can assist with protecting it. But the developers really understand need to know. They understand the intimate details of their projects they're working on. Um, they understand it very well, but often they can't communicate it. But they're the first to realize when it's been released inappropriately. Hey, that's our stuff. We should have been protecting it. And so the way I see it, the FSO can assist with their training and their skills to pull out this information and identify it, protect it. We'll call that derived information, right? When you're developing products, you're deriving that information from the work product that the government gave you. And so while the um developer may not be able to communicate what needs to be protected, or the FSO may not fully understand, um, I'm recommending an information protection or an insider threat program working group that that puts together the FSO, the insider threat protection official, the senior management official, all those required um positions with each and every um developer that's there. And so you can build that information protection and focus on that inform on that information by identifying what it is, who should have access to it, and how it's protected. So that if, for example, one of your insiders that does not have access to that information requests it, they can say, No, you're not on my program or you don't work on this product, you can't have it. But until that happens, many times people um uh don't fully understand what need to know means. All right, I would like to tell you now, uh give you a special message from SIMS Software, S-I-M as a Mike S Software. As clear defense contractors, you represent the backbone of innovation, the front line of our national security and protectors of all that we hold dear. SIMS Software is proud to be your ally in these endeavors. As most trusted name in industrial security information management for over 38 years, Sim Software equips you with the tools to protect the lifeblood of your organization. Our flagship Sims Suite provides all the features and functionality you need to run an automated, paperless industrial security program. Gain a 360-degree view of every physical, virtual, and human asset inside your security domain. From classified documents and materials to cleared personnel, facilities, visitor control, information systems, and more.com or call 858-481-9292 or see our show notes for more information.

SPEAKER_00 8:52

Yeah. Well, and I love how you talk about it in the book. So, you know, how this is why would folks want another resource for insider risk or insider threat beyond the NISPOM? And it's I think the government has done a better job about clarifying and caveating that the NISPOM is not an end-all-be-all. If your company is only doing the minimum requirements of the NISPPOM or of CMMC or whatever the requirement is, you might not be prep prepped for the current landscape. And you're gonna see some definitions in the NISPPOM that you're gonna be required to comply with, but like you note, there's also a lot of flexibility in terms of the roles you assign and your working group and things like that. So, you know, maybe talk about that. Like the NISPPOM is kind of a starting point, but why is it not the finish line for, especially for cleared contractors?

SPEAKER_01 9:41

Right. Okay, good. Yeah, and I'll use that similar um analogy with a um with technology. A lot of people go out and say, hey, I have an insider threat program, and and they'll use a third-party technology or a software, and they'll call that their insider threat program. Many people will brief that. Those are good, good technology, good software. But you know, if you build a secure room and you don't put anything inside of it, it's not doing much good. So if you buy this technology and you don't identify what needs to be protected in there, it's not that good. Um, so what I recommend uh to answer your question is with these insider threat working groups, you would have the facility security officer who may facilitate it, and then you would have the appropriate people in that meeting who works on that product. And so maybe it's a guidance system. And you would facilitate in that meeting, hey, what do you see as um sense of information in this uh system that you're developing? What do you feel like that we need to protect a little bit better? And who needs access to that information? Um for example, the um company's chief financial officer will need um financial reports to be able to report and understand how their business is doing. But do they need to know who is financing that project, for example? Um, how much information about our project should we give away? Um a lot of people, um a lot of uh FSOs and people that I talk to who don't understand need to know, understand that NISPOM says to be able to access classified information, you should have a clearance, you should have the um um uh SF312 briefing and need to know. But a lot of people think one plus two equals three, the briefing plus the acts uh plus the clearance equals need to know, but that's not the case. And then so some people who say, no, Jeff, we do better, we do by contract. I said, contract numbers you need to know. I said, a lot of times that does work, but sometimes contracts um have different task orders or different work products, such as a software developer or a hardware developer. Does a hardware developer need to know the intimate details of how the software is um developed? And does a software uh developer need to know the um capabilities of the system, or do they just need to know how their software needs to work inside that system? And so these working groups um should be able to have those discussions, um determine what is sensitive based on those discussions, determine who needs access to it, and and um determine uh how to protect it and then train the force on that, and then use that working group to um develop um incident responses and file reports as needed.

SPEAKER_00 12:40

I love that. You're so timely, Jeff, talking about need to know because this has like been our key mantra with clearance jobs. Having a security clearance does not give you need to know. So and I love that you you can get it. That's not carte blanche like need to know. Um and I think you make a good point. It's not necessarily been based on the contract. Like you, we have to look a lot more nuanced at what need to know means um and protecting our protecting class of information at at the data set or at the information set um is is so important. So could you yeah, can we maybe talk to that a little bit more when it comes to an insider threat program? Do you think um, I don't know, what what are what are some of the key takeaways for folks who are you know trying to address that need-to-know piece with their insider risk management program?

SPEAKER_01 13:28

Yeah, I like to say, for example, um for need to know, what is your work product? Instead of basing it on a broad scope like a contract, a contract could be an entire complicated system. But if you're only working on one aspect of that system, um draw out from those individuals. So you might start out with a large working group of the whole system, then you might realize, okay, not everybody needs to know how everything about the system. So let's break it up. Let's break it up into the navigation system. Uh those people who work on that, the propulsion system. For example, if I'm talking about an airplane, the propulsion system, uh, and and maybe even the um well, we got navigation propulsion, and just let's just use those two for an example. Um, the the people working on the propulsion system don't need to know if there are is proprietary information or classified information uh about particulars about that navigation system and its capabilities that might be unique. And the um navigation developers may not need to know about the um special engine that you're using or the or the fuel that you're developing for it. So this works again in in cases of can be applied in many cases not only to defense contractors, but you know, um even a sales company, for example, who um has a large territory, uh not every you know, the first thing that we do when we leave a job, we take our stuff with us, right? That could be in a sales company, could be the customer list. Customer lists are very important. So does the customer um does the the does a salesperson from um one territory need to know the customer list from the other territory? And and or or does the manager need to know all that information? So when you're determining need to know at least in a defense contractor, um you might start out with, okay, I have a CEO, I have a CFO, I have an FSO, an insider threat protection officer, I have program manager for for the propulsion and program manager for the navigation system. And then I have this information about the navigation system, I have this information about the propulsion system. What does the CEO need to know? What does the FSO need to know? Do they really need they may have access to it, but do they need to know these intimate details or just what they should know to help me protect it or should know to run this company? You know, we we often hear that story about the executive assistant who leads a a soda who leaves a soda company and goes to their compet competitor with a secret formula from that soda company. Why does the executive assistant have that access to that information? And and so um so what we want to do is just logically think about the information and who who works with it. If they don't work with it, they don't need access to it. And if they ask for it, that's a trigger. They could be in ignorance, but if they keep asking for it, there might be a reason.

SPEAKER_00 16:35

Yeah. No, I love that you flagged that. I was just in a conversation with somebody talking about that exact thing. Like how much information does the CEO need to know? Or same with board members, right? We have a lot of our entities around us. I know that's been a topic of security clearance reform efforts, how to get key management personnel, or are you know how do we how do we clear those folks? You know, my philosophy is when I was around the vetting scenario of it. I think vetting people is always a good idea, just because we've been then then we've actually created punitive options for if they disclosed or misused, then we can't create training requirements for them. But like you said, the need-to-know piece of it still remains key because if you just assume, well, my entire board is cleared, so they should know all this. Well, what do they actually need to know for their position as board members? Do they just have carte blanche access to everything? Um, I think thinking through those questions for companies, and they're probably going to be different company to company is really important.

SPEAKER_01 17:35

Right. Yeah. And one of my colleagues says, um, you know, Jeff, it's not that we have too many people cleared. You can have all clear, you can clear everybody. It shouldn't matter if you have a need-to-know program established and a good information protection program. That way, if you have an issue with too many people cleared, well, at least you can control who accesses it in an intelligent way.

SPEAKER_00 17:58

Yeah. So I want to talk about reporting. You have a whole chapter on reporting in this. This is always a topic at clearance jobs. So we know kind of folks operating under the NISPOM manual are going to be a key audience for this. Folks looking at having an insider threat program. Um, you know, again, commercial or or government are kind of looking at those reporting requirements. Reporting requirements specific to government contractors in seed three, I think, still create some confusion. Um and we even just see in in leak cases, a lot of times there is information that is noted and that is reported. Um, so maybe if you could talk through are there best practices for reporting framework? Have companies done really well? Because I always see like, I don't think there is a is one way to do it, right? You just have to report. But a lot of folks will ask, well, how do we do that? I'm like, well, I think you just you as a company organization, do you have an anonymous email? Do you report to the security officer? Do folks know who their security officer is, who they should report things to? Like those are, can you talk to that the reporting piece of it?

SPEAKER_01 18:56

Yeah. So the reporting piece, again, I focus this strictly on classified information. And so the way I like to work with my clients is every output becomes an input to the next step. And so I want to leverage everything that we have already, not create additional work for the FSO. Um, I'm a big advocate, is if you are a clear defense contractor under NISPPOM establishing an insider threat program, the FSO or somebody that works with the FSO should be the ITPSO because they are running that security program to protect classified information. However, if you're going to expand past classified information into CUI, ITAR, proprietary data, you might you might want to have a larger ITPSO. But as far as reporting, I would leverage current the current reporting requirements. We already know that espionage needs to be reported and that suspected security violations need to be reported. So a lot of insider threat violations are going to be security violations. Or if you actually catch an insider walking out with something, it's going to be a security violationslash espionage issue. So those reports, I'm going to say report it to the FSO, don't go straight to the FBI.

unknown 20:14

Ms.

SPEAKER_01 20:14

Bomb says go to the FBI, but use your chain of command unless your chain of command is the issue. And then um, so leverage those reporting processes that are in place that'll make your life so much easier. And and I'm also a big advocate of um, you know, you have possessing facilities that have classified information on site, but even non-possessing facilities should have an insider threat program. Um, my buddy has one, he's got two people in his company. They you've got to have one. But but perhaps maybe you're a non-possessing company, but your employees sit and do classified work at another location. Have your IT insider threat program working group coordinate with the other insider threat program working group, and maybe you can share data as it relates to information or potential violations. And so um you become a stronger team that way. But but with the reporting, um, the CIAD reporting, the required um what do we call it, incident response reporting or adverse information reporting, those fit under the insider threat program reporting guidelines.

SPEAKER_00 21:22

Okay. So we talked a little earlier about insider threat training. Um, this is kind of a topic, I think an area of low-hanging fruit for a lot of companies, maybe um, that have been potentially set something up when those requirements first came into place. But probably a lot of, again, uh I think it's a good time to update those even now. And I think even what you said here about protecting information is a good piece of it, because again, a lot of those are focusing on human behavior and individuals, which are true, but we're not necessarily training on protecting the information piece of it. So, can you talk a little bit about the training side of an insider risk management program?

SPEAKER_01 21:55

Yeah. Yeah, so insider threat, like like a like we talked about in NISP. Incidents. Insider, there are many training requirements leveraged for clear and um put on cleared employees. You know, you might have um the SF 312 briefing as well as security awareness training, but each one of those requires an insider threat module. And then there's the insider threat training on top of it. Um so I would definitely have that insider threat program working group develop that training and make it specific as possible to that information you're trying to protect. That way, um, you know, you've been in a cleared employee for 20 years and you're still getting briefings on what secret, top secret, and confidential means, right? You're like you're pulling your hair out. Like, can I have something more advanced more to my skill level? And so um you have leverage with these insider threat program training to um really be specific with your employees. Um, and so what you might want to do is once you inside establish your insider threat program, train them on that program, train them what to report, when to report, how to report it, how to recognize an insider threat incidence. And it all and it and it should begin with um, hey, we've identified this information as classified. You have access to this, you know your need to know. Anything happened outside of this, then you um report it. And then a separate insider threat program um working group uh training for those people who work on the working group.

SPEAKER_00 23:39

Awesome. Well, those are my only questions. Is there anything we didn't get to or address about your new book or about even this hot topic of insider threat that you wanted to go over today?

SPEAKER_01 23:49

Well, okay, sure. Can can I um talk about my website?

SPEAKER_00 23:53

Yes.

SPEAKER_01 23:54

Okay. Um yeah, so if you have any questions about um establishing an insider threat program, I can assist you with doing that. I do that a lot, or an information protection program. But um, if you want to try it yourself, um on my website, uh redbike publishing.com slash insider threat program, um, I sell my book there, but also um I have a lot of required things for you to use, download, and and modify. For example, I have I do have insider threat program uh training for employees and for insider threat program um employees, as well as tools and templates that you can download, including appointment memos, insider threat uh program working group, um assembly memos, and also agendas and um matrices that you can use to fill out to identify what needs to be protected and um who should act.

SPEAKER_00 24:51

Awesome. I love it. Now is a good time. If you have not refreshed your insider threat training program, uh do it now. And I do like I think I think the focus on need to know and information protection is key and is a real pivot that we need to make in terms of how we're addressing this. So I appreciate your time so much, Jeff. Thank you for your contributions. Uh always appreciate your writing and appreciate your joining us to chat about the book.

SPEAKER_01 25:12

Thank you, Lindy. I appreciate all the opportunities you're giving me. Security clearances. We hope you come back for another episode. And please look at our show notes, and you can find more resources that might answer your questions on how do I perform once I win a classified contract? And what do I do once I get a security clearance? And the other question is how do I get a security clearance? We are here to help you out. Help you every day when you visit our show notes that you will find those resources, as well as access to my other company, Five Analysis Group, where we actually perform this contest and as well as FSO or Metcalf Consulting in case you have that need. Wish you all the best, and we'll see you next time.