Implementing an Effective Insider Threat Program for NISPOM Compliance

 description

NISPOM Compliance Consulting and FSO Services: https://www.thriveanalysis.com

NISPOM Books and Training Resources https://www.nispomcentral.com

Contact Jeff: jeff.bennett@nispomcentral.com

Implementing an Effective Insider Threat Program for NISPOM Compliance

Jeff Bennett from Thrive Analysis Group discusses the importance of implementing an aggressive insider threat program to ensure NISPOM compliance. He explains how such a program can protect sensitive information within clear defense contractors, commercial entities, institutions, and nonprofits. The video outlines the identification of sensitive assets, developing countermeasures, and training employees to recognize and report suspicious behavior as focal points of a robust insider threat program. Continuous evaluation, education on adverse information reporting, and practical steps for effective insider threat management are also covered.

00:00 Introduction to Jeff Bennett and Thrive Analysis Group

00:25 Understanding Insider Threat Programs

01:52 Identifying Insider Threat Behaviors

03:28 Implementing a Robust Insider Threat Program

05:27 Continuous Evaluation and Reporting

09:55 Training Employees on Insider Threats

12:36 Conclusion and Contact Information

NISPOM Central
Providing security clearance books, training, and resources for cleared defense contractors.

Clearance, NISPOM, and FSO Consulting
Thrive Analysis Group Inc is your resource for security clearance, NISPOM, and FSO consulting.

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Transcript

Copy Transcript Copied

SPEAKER_00 0:01

Welcome to DOD Secure, and I'm your host, Jeff Bennett. Well, thanks so much for joining us. I decided to put the applause track back in because it was so much fun, and I hope you don't find it annoying. I hope it pumps you up for a very important discussion that we're going to have in this podcast. Hi, I'm Jeff Bennett. I'm with Thrive Analysis Group, and we are a NISPOM Compliance and FSO consulting company. I also have a company called NISPOM Central, and we have books, training, and resources for NISPPOM compliance. I have linked to both in my description, and I hope you'll benefit from the content as well as you can subscribe to this channel. So today's video is about engaging your company with an aggressive insider threat program. And this ensures an excellent compliant NISPPOM or National Industrial Security Program. While this applies to clear defense contractors, it also applies to those desiring to protect sensitive information. Now this could have commercial application, institutional application, as well as nonprofit organization application. Anybody who desires to protect customer, proprietary, intellectual property, privacy, or other types of sensitive information can benefit from this video. The premise is stopping trusted employees or trusted persons from pilfering sensitive information outside of the organization. So you might recall news reports or events about trusted employees providing unauthorized information to unauthorized persons. We typically call these spies. Sometimes they can also be hazardous or hapless victims of their disorganization. So a good insider threat program will also prevent ways that these employees could either accidentally or purposefully expose sense of information. And we want to make sure that our employees understand what their roles are and what is required of them. And a robust insider threat program can help do that. Experience demonstrates that these employees who have been caught spying had displayed signs, habits, and behavior upon looking back, not predicting behavior head, but upon looking back, there's behavior that indicated that they were indeed an insider threat conducting insider threat events. For example, they were spending extra time at copy machines making copies of sensitive information that they were not authorized to do. Additionally, they are unauthorized collection of data on storage devices such as thumb drives, telephones, or cell phones, or other collection devices, and there are so many more incidents of people getting access to information that they did not have a need to know or any other purpose having. In and of themselves, many of these may not be reportable events, but consolidated this behavior proved to be indicators that should have had further investigation. These days, it could be well understood in the National Industrial Program community, or those communities operating under the NISPOM, clear defense contractors and such, that employees should be assisting with the insider threat program. The NISP has tied such reporting to job performance and future employment. To be successful, FSOs provide NISPPOM-based programs and training to provide trained, knowledgeable, and dedicated employees. While some have done this, others could do better and improve their training programs. This plan that I am about to present to you can be applied again across the board and it will help prevent insider threat events. After all, a cleared contractor determines whether or not an employee requires access to sensitive information. And the way they do that is providing a security clearance. The contractor requests a robust security clearance, background investigation from the government. The government does the investigation and either denies or approves a security clearance. The same way non-government organizations may do a background check as part of the pre-employment package. So this can also be applied to vetted employees of other types of organizations. Once the contractor submits a security clearance request, the employee is subject to a rigorous background check and they are well vetted. If results are favorable, then again, that employee will be granted a security clearance. And again, this process can be used for other applications outside of DOD. Now, throughout the employment, vetted employees are required in the government and under NISPPOM to report any information that would lead to a decision that involved cleared employees or lead or they should report any behavior that would lead to a decision by either the facility security officer or the government that a cleared employee should become a security risk. Now, this is called adverse information reporting. Cleared employees are required to report adverse information on themselves and other cleared employees. Some of this information I'll cover in other briefings, but suffice to know that failure to report adverse information could be discovered later during the continuous evaluation process that I'll be describing. So vetted employees are required to go under continuous evaluation program once they get their clearance, and every five years they'll be reinvestigated. During this five-year term, and employees are required to report on themselves. Some of it is adverse information, but some of it is just mandatory reporting, such as foreign travel, a name change. In and of themselves, foreign travel or a name change is a pretty much normal event. The reason that the continuous evaluation involves identifying reportable information is that it may not indicate an insider threat activity, but could be applied to insider threat programs. Continuous vetting is used to maintain security clearance eligibility, but it may not be enough to determine who an insider threat might be. Adverse information such as drugs, alcohol, and behavioral issues must be reported because they are red flags. However, it does not mean in and of themselves that those are insider threat events, but they just may be need to be reported. While these reports may not be enough to determine who an insider threat might be, they may require additional countermeasures and reporting requirements just to hash out if there are other events that need to be reported. Now the reason that the continuous evaluation involves identifying this reportable information is that they may or may not indicate an insider threat as discussed earlier. So why not emphasize a higher degree of continuous evaluation topics? A higher degree meaning somebody has demonstrated behaviors of ignoring security requirements. That may indicate an insider threat and should be looked at at a higher degree than somebody who's going through a name change. So why not do that? Why not focus on behaviors that indicate an insider threat? Or if your company performs sensitive work, you are already aware of risks to the products. You understand what your products are, how they're sensitive, and the impact to your organization if this information were to be leaked out or provided to unauthorized persons. If your company performs sensitive work, you're aware of the risks to the product, to the proprietary information, to trade secrets, personal information, and so on. Why go through the excruciating work of identifying and protecting sensitive information only to be unable to control what employees do with it? What is the best method for instituting a robust insider threat program? There's a few steps. One, you have to identify sensitive assets. And what I mean by identify sensitive assets, identify it by its form, fit, and fashion. Don't just say, hey, I have gold and it's very sensitive. But document how the gold exists. Document if there are any procedures that you use that gold for. Document the format that the gold exists, the weight, the purity of it, and where it resides. Identify it, then document it so everybody understands where it resides, and then develop additional countermeasures. For example, if you have sensitive information and you desi and you you've identified it by form, fit and fashion, then you might need to consider who has access to it based on its form, fit, and fashion and that employee's work requirements. That's called need to know. Develop those additional countermeasures and then develop steps in place where you would identify when an employee is gaining access to that sensitive information or item in an unauthorized manner. So instead of, for example, spying on employees, waiting to trip them up in behavior, develop triggers so that you know an employee is getting access to it. For example, why is an employee making hundreds of thousands of copies of information? Why is an employee downloading information into a thumb drive or a DVD? These are questions you can ask and determine if that's authorized use of that equipment. This unauthorized access or use may be an indication of a reportable subject matter that's falling under the insider threat program. How does training your employees to be in this part of this robust program? Reportable information involves a long list of events that may be too much to memorize. So that's where your NISPOM required training comes in, or that's where your security training comes in, or even insider threat training. It's not as so important to be able to recite those reportable incidents as it would it's just to understand what is reported. We need to report behavior that is suspicious. Getting employees to understand what to report and who to report it to is very important. Just go through your company and ask the question. If you saw something suspicious, who would you report it to? Who is your security officer? Who is your insider threat protection senior official? Many people may not be able to answer your question, even though you've hammered it in earlier training. Be sure to make it obvious and clear and coach your employees through that. Because if they do see something, they need to be able to report it to a responsible person. In addition to training your employees on what is reportable, train them on the topics exclusive to the insider threat activity. Yeah, I understand I need to report a name change, it may impact my security clearance. But I also need to report other events such as somebody asking me for information that they don't have access to. That's something I should think about reporting. And then spell it out for your employees to be able to understand it. In other words, a person who changes their name or gets arrested, that's required reporting. But there's also some other nuances that your employees may not be aware of that you may want to start in your insider threat program to help identify which activities may need to be reported. Once you get that figured out, break out your training into bite-sized portions. Lay out categories so that employees feel comfortable that these categories are worth reporting. Why? Because the greatest risk to sense of information comes from within the organization. Yeah, we can set up countermeasures to keep bad outsiders outside of organization. We set up alarms, we set up locks, we set up guards, we put combinations on things. But it is rare when somebody breaks into an organization to steal. What is more common is people with access to it, those trusted employees that are walking out with it. Since this is the greatest threat, why not take time to develop a program to ensure employees continue to demonstrate ethical and legal activity as well as understand what to improve report. If you need any assistance at all on your insider threat program, training program, or your security program, feel free to contact me. It's in the notes and in the comments below. Please feel free to reach out.