Insider Risk Evaluation and Audit

Abstract

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

Identifying at-risk employees: A behavioral model for predicting potential insider threats

“…Good managers and HR staff are well aware of incidents and issues relating to "concerning behaviors" such as increasing complaints to supervisors regarding salary, increased cell phone use at the office, refusal to work with new supervisors, increased outbursts directed at coworkers, and isolation from coworkers (Randazzo, Keeney, Kowalski, Cappelli and Moore, 2004;Shaw and Fischer, 2005;Cole and Ring, 2006;Phelps, et al, 2007;Shaw, Fischer and Rose, 2009). For the most serious occurrences, which are the focus of our model, there will be communications and discussions among HR staff and management.…”

“…To protect all parties, systematic methods are needed to reduce the risk of deliberate attempts to harm organizational interests or individuals. Research shows that in the preponderance of cases the malicious intent of the perpetrator was "observable" prior to the actual exploit (Randazzo, Keeney, Kowalski, Cappelli and Moore, 2004;Shaw and Fischer, 2005;Cole and Ring, 2006;Phelps, Cappelli, Moore, Shaw and Trzeciak, 2007;Shaw, Fischer and Rose, 2009). Considering this research literature along with input from human resources staff, we developed a prototype psychosocial model that uses twelve behavioral indicators to predict the level of risks of insider threats.…”

“…Along these lines, a Defense Personnel Security Research Center report advocates design of insider risk mitigation plans for individual employees. These plans take into account employees who display one or more concerning behaviors indicative of increased risk, such as an IT security violation or an altercation with his supervisor or coworkers (Shaw, Fischer and Rose, 2009). These behavioral manifestations may then justify the organization to conduct an insider risk evaluation.…”

Assessing Continuous Evaluation Approaches for Insider Threats: How Can the Security Posture of the U.S. Departments and Agencies Be Improved?

“…(IAEA, 2008) "malicious user" (Caputo and Stephens, 2009) "trusted insider" (Shaw, Fischer, and Rose, 2009) "infiltrator" (Catrantzos, 2010) The Violent Insider "the active shooter" "the lunatic" "the deranged" (RAND Corporation, 2016)…”

Spy the Lie: Detecting Malicious Insiders

“…Their findings indicate that personality disorders 57 and vulnerabilities within organizations and industries impact the psychosocial behaviors of insiders. 58 A recent study conducted with human resources professionals 30 identified twelve leading psychosocial indicators (see Table 1) of behaviors that would cause enough alarm to elevate personnel monitoring. The study further revealed that low-risk indicators only became alarming when presented with one or more high-risk indicators.…”