Insider Threat Awareness Answers

The definition is correct, but the added claim 'Spills are the most common form of insider threat' is NOT supported by the February 2024 INT101.16 student guide, which makes no such statement. The only 'most common' claim in that guide concerns adversary collection methods ('The most common methods, used in over 80% of cases'). Recommend dropping the 'most common' sentence.

Workplace Bullying/Violence. It is intentional, disruptive physical, verbal, or written behavior committed by an individual or group that physically damages a facility, or psychologically or physically harms an employee.

Leak. Leaks are the intentional, unauthorized disclosure of classified or proprietary information to an unauthorized person or organization.

Obesity. Examples of insider threat vulnerabilities include: financial stress, exploitable promiscuity, addictive behaviors (drug/alcohol abuse, gambling, pornography), loneliness, and disgruntlement.

All of the above. All of these are reportable behavioral indicators that have been associated with insider threat.

False. Since the end of the Cold War, 37% of spies had no security clearance. Adversaries target anyone with access to useful information, regardless of clearance level.

Tell them what they want to know up front. Proper deflection methods include referring to public sources, stating you don't know, deflecting with your own question, or stating you cannot discuss the matter.

All of the above: Allowing more information to be accessed easily, allowing more information to be transmitted easily, and allowing more information to be edited easily.

Hoarding files, data, code, and programs. This is a technology-related behavioral indicator that should raise suspicion of insider threat activity.

Copied the documents onto a rewritable music CD. Manning brought music CDs to work under the pretense of listening to them, erased the music, then wrote compressed classified data to them.

All of the above. If you witness or experience any behavioral indicators, you must report them to your immediate supervisor and/or your local Security office.

A person who has or had been granted eligibility for access to classified information or eligibility to hold a sensitive position. (DoDD 5205.16 keys the definition to clearance/sensitive-position eligibility — not merely to having access to DoD resources through employment, volunteering, or a contract.)

The threat that an insider will use his or her authorized access, wittingly or unwittingly, to do harm to the security of the United States. This can include damage through espionage, terrorism, unauthorized disclosure, or loss/degradation of department resources or capabilities.

OUT OF DATE: the current (February 2024) INT101.16 guide lists FOUR categories, not five, and does not attribute them to the NITTF. They are: (1) Unauthorized disclosure -- which SUBSUMES both leak (intentional) and spill (unintentional) as its two forms, (2) Espionage, (3) Sabotage, (4) Targeted violence. The 'five categories (Leaks, Spills, Espionage, Sabotage, Targeted Violence)' framing is from a retired version of the course. Recommend rewriting to: 'Four: Unauthorized disclosure (leaks and spills), Espionage, Sabotage, and Targeted Violence.'

The unauthorized transmittal of classified or proprietary information to a competitor, foreign nation, or entity with the intent to harm.

To deliberately destroy, damage, or obstruct, especially for political or military advantage. Motivations can also include personal disgruntlement.

Any form of violence that is directed at an individual or group for a specific reason. Targeted violence is not a random act.

Active Shooter, Domestic Violence, Harassment, Hostile Work Environment, Sexual Assault, Stalking, Threats/Threatening Behavior, and Workplace Bullying/Violence.

A person actively engaged in killing, or trying to kill, people in a confined and populated area. Active shooters are not limited only to the use of guns.

Any unwelcome written, verbal, or physical conduct that objectively creates a hostile or offensive work environment. It may or may not be based on age, color, gender, disabilities, national origin, race, religion, or other protected categories.

Behaviors that are severe or pervasive, and perceived as unwelcome or offensive.

Harassment, unwanted, or threatening physical, verbal, written, or virtual conduct that causes the victim, or could cause the victim, to fear for his or her safety or the safety of a family member.

Any use of words or actions that may intimidate or provoke a reasonable person and/or interfere with the performance of official duties.

Financial stress, exploitable promiscuity, addictive behaviors (drug/alcohol abuse, gambling, pornography), loneliness, and disgruntlement.

Seldom impulsive. Something happens over time that contributes to a trusted insider evolving into a malicious one, usually some sort of perceived life crisis.

Significant changes in personality/behavior/work habits, substance abuse or addictive behaviors, considerable financial change (unexplained affluence or excessive debt), disgruntlement to the point of retaliation, disregard for security procedures, seeking access without need-to-know, after-hours access, and unauthorized copying/hoarding of classified material.

Say something. Notify the appropriate company representative who can help get the assistance they need before the situation escalates. Identifying colleagues who may be in need of help is not an act of betrayal; it is an act of respect.

A technique where an adversary uses romantic or sexual relationships to recruit or exploit an insider. Benjamin Bishop, a 59-year-old defense contractor, was caught in a honey trap when he passed nuclear secrets to a 27-year-old Chinese graduate student.

A technique used to discreetly gather information through a conversation with a specific purpose: to collect information that is not readily available and do so without raising suspicion. The conversation can be in person, over the phone, or in writing.

It exploits natural human tendencies: desire to be polite and helpful, desire to appear well-informed, tendency to expand when given praise, tendency to gossip, tendency to correct others, tendency to underestimate the value of information, and disinclination to be suspicious.

Refer them to public sources, ignore improper questions and change the topic, deflect a question with your own, respond with 'Why do you ask?', give a nondescript answer, state you don't know, state you'd need to clear discussions with your security office, or state you cannot discuss the matter.

Foreign governments, terrorist organizations, competitors, and non-state actors all want non-public information that an insider can provide.

Who are the organization's personnel, with which countries does the organization work, what are the organization's methodologies/capabilities/limitations, and where are the organization's facilities located worldwide.

Direct approaches (during travel, persistent requests to socialize, conference requests), exploitation (excessive photography, concealed listening devices, malicious emails, unsecured Wi-Fi), and elicitation.

Take down the person's name and organization, date, time, location, method of contact, and reason for contact. Report this information to your organization's security office.

67% of spies have been civilians. Also, 37% had no security clearance, 84% were successful, and 67% volunteered to commit espionage.

81% received no money for their services. 94% went to prison.

Improper use of privileged access, working odd hours without authorization, bypassing security rules/protocols, inappropriate copying of classified info, requests for access beyond scope, introducing unauthorized devices, keeping unauthorized backups, unauthorized removal of equipment, and hoarding files/data/code.

Two refinements per the current CDSE guide: the guide says Martin stole classified data 'over 30 years' (the answer says 'more than two decades'), and it records the disposition -- he was SENTENCED TO 9 YEARS, not merely 'arrested.' The guide describes him as 'a defense contractor' rather than specifically 'an NSA contractor.'

Greene was an FBI translator with Top Secret clearance who was assigned to investigate an ISIS recruiter. Instead, she traveled to Syria to marry the terrorist she was supposed to be watching, after falsely stating she was visiting family in Germany. She was sentenced to two years in prison.

Use strong passwords, keep out unauthorized devices, prevent unauthorized access, inventory tech holdings, ask questions and take training, watch for behavioral indicators, and be cautious on social media.

In the social media age, people share details of their personal and professional lives online, making them much more vulnerable to adversaries, competitors, and cyber-criminals, who all use the Internet as a key targeting tool.

A program that offers financial counseling, mental health support, and other services to help employees address problems before they escalate. Most EAPs recognize diagnosable addictive disorders as treatable illnesses.

Personal foreign travel (even Canada) must be reported. Personal foreign contacts and outside activities involving Intelligence Community information must also be reported.

Events that impact facility status, personnel security clearance, proper safeguarding of classified information, or indications that classified information has been lost or compromised. Reports go to DSS and the FBI.

Unauthorized disclosure, improper use of privileged access, working odd hours without authorization, bypassing security rules, inappropriate copying, requests for access beyond scope, unauthorized devices, unauthorized backups, unauthorized removal of equipment, and hoarding files/data.

The belief that we are not susceptible. People are naive and complacent, in denial that something could happen to their organization.

Photographing documents with a cell phone in the SCIF, changing screens when people entered the room, a new unexplained romantic relationship, unreported foreign travel (London), and suspicious online gaming contacts.

They rationalized and explained away the suspicious behavior instead of reporting it. Tom even tipped off the suspect by confronting him directly, instead of reporting to the security officer. They should have contacted their security officer immediately.

Espionage. Justice, an aerospace engineer, attempted to sell satellite secrets to someone he believed was Russian intelligence. His vulnerabilities included disgruntlement (felt unappreciated at work) and personal stress (caring for a sick wife).

Targeted Violence (Active Shooter). The disgruntled former employee returned to his workplace and killed five coworkers. He had a history of negative relationships and had battered another employee previously.

Leak. Manning, a U.S. Army intelligence analyst, leaked more than 750,000 classified documents to WikiLeaks in 2010 by copying data onto rewritable CDs labeled as music.

Were known to have displayed concerning or problematic behavior before acting directly against their organization. This behavior included violations of policies, standard procedures, accepted practices, or laws observed by managers, supervisors, and coworkers.

Violence, usually physical abuse or threat, that creates a risk to the health and safety of an employee. It includes any abusive, violent, coercive, forceful, or threatening act used to gain power and control over a household or family member, current or former spouse or partner.

A range of behaviors including completed or attempted nonconsensual sex acts and abusive sexual contact. It includes any sexual act perpetrated without consent, whether due to force, threat, incapacitation, minority, or inability to consent.

False. Seeking assistance is a sign of good judgment and an act of bravery. Identifying colleagues who may need help is an ultimate act of respect for their safety, the company, and the nation.

Be prepared by talking to your security officer first, beware of odd behaviors like repeat requests or suspicious business cards, and reduce exploitation by using VPN on Wi-Fi, screening suspicious emails, and never loaning your devices.

$300 billion worth of American intellectual property and business intelligence are stolen yearly by China, Russia, Iran, and others.

Bishop, a 59-year-old civilian defense contractor, pleaded guilty to passing nuclear weapons secrets to a 27-year-old Chinese graduate student he met at an international military conference. He was caught in a honey trap and sentenced to 87 months in prison.

Report the concerning behavior to your security officer. Financial stress combined with seeking additional income opportunities is a behavioral indicator of potential insider threat vulnerability that could be exploited by adversaries.

False. You should report suspicious behavior to your security office. It is their job to investigate. Do NOT confront the individual or conduct your own investigation, as this could compromise an official investigation.