National Insider Threat Awareness Month (NITAM) reminds organizations – including the Coast Guard – how important it is to recognize and report behaviors that could negatively impact national security.
Federal institutions are vulnerable because employees and contractors need authorized access to worksites and/or protected information in order to get the job done. Insiders become threats when they use this access to cause harm. This is true whether bad actors intentionally or unintentionally sell secrets to a foreign power, sabotage equipment, steal trade secrets or accidentally cause a data breach.
As September winds down, how good are you at recognizing potential insider threats? Take this quiz and find out.
- A federal contractor is assisting your team on a project. She’s been around the government for years and is seen as a hard worker willing to go the extra mile to get the job done. Recently, she asked if you could show her some files that are on a server that she doesn’t have access to. When you told her she’d need to ask your boss, she said he’d blown her off. Then she told you a story about a previous project where she had to talk a colleague into sharing code that was supposedly restricted, saying, “Seems like that’s the only way things get done around here.”
Is there a potential threat here?
A. No. The woman has a good reputation and you are working together. Plus, she’s got a deadline to meet. You’re only slowing things down by being a stickler for rules.
B. Yes. Trying to get access to information you don’t have clearance for can be a sign of an insider threat. Just because someone thinks they have a need to know doesn’t mean they have a valid reason if the information is restricted.
Did you choose B? You would be correct.
- A coworker with a security clearance takes frequent vacations. More than it would seem he can afford. He says he made a lot of friends overseas when he lived there, so people put him up and entertain him. But when another colleague asked about a trip he’d gone on, he said he didn’t know what they were talking about. You’ve also noticed that although he often posts family pictures on his social media, he doesn’t post anything from his vacations.
Is there a potential threat here?.
A. No. Give the guy a break. He’s allowed to have a personal life and doesn’t have to share the details at work if he doesn’t want to. It’s really no one’s business.
B. Yes. People with security clearances are required to report overseas trips. Frequent foreign travel or contacts with foreigners can be indicators of an insider threat.
B is the correct answer.
- A friend is in human resources. Like a lot of people, he worked from home during the pandemic and still only comes into the office part-time. He does a lot of work with databases and is still in the habit of emailing information to himself to complete projects. He often sends it to his personal email account, which is easier to pull up on his home computer.
Is there a potential threat here?
A. No. The guy is just trying to get work done. There’s no evidence he’s sharing information with outsiders or unauthorized persons.
B. Yes. Security experts estimate nearly 70% of data breaches are not intentional. Your friend may think he’s being careful, but by sending sensitive data to a commercial account, he’s putting it and potentially individuals he works with at risk.
B is the correct answer.
- Your new coworker, who is from a country frequently at odds with the U.S., is very quiet and keeps to herself. On the phone, she often speaks in her native language. She seems reluctant to join in after-work social outings and doesn’t stay to chat after meetings. In general, she seems standoffish and it makes you uncomfortable.
Is there a potential threat here?
A. Yes. Why doesn’t she talk in English if she has nothing to hide? She was born in a country that is one of our enemies, what if she’s giving them information?
B. No. She might just be very introverted. Unless she’s done something to indicate violence or a desire to harm the U.S., this isn’t a reportable event.
B is the correct answer.
Source: Compiled with information from NITAM, the Center for Development of Security Excellence (CDSE) and other reports.