M01_L01 M01_L01 Insider Threat M01_L01 links ReadOnlyText pageLocation Page x of y helpBtn Help. Select this button to open the help panel. HelpButtonClicked exitBtn Exit. Select this button to exit the course. ExitButtonClicked mainMenuBtn Main Menu. Select this button to access the main menu. MainMenuButtonClicked glossaryBtn Glossary. Select this button open the glossary. GlossaryButtonClicked resourcesBtn Resources. Select this button to access the resources for the course. ResourcesButtonClicked hideCCBtn Hide Captions. Select this button to hide the caption text. HideCCButtonClicked showCCBtn Show Captions. Select this button to show the caption text. ShowCCButtonClicked turnAudioDescriptionsOffBtn Turn Audio Descriptions Off. Select this button to turn off audio descriptions. AudioDescriptionsOffButtonClicked turnAudioDescriptionsOnBtn Turn Audio Descriptions On. Select this button to turn on audio descriptions. AudioDescriptionsOnButtonClicked skipReverseBtn Skip Backward. Select this button to skip a few frames back. SkipReverseButtonClicked skipForwardBtn Skip Forward. Select this button to skip a few frames ahead. SkipForwardButtonClicked replayBtn Replay. Select this button to replay the current screen. ReplayButtonClicked transcriptBtn Transcript. Select this button for a transcript of the current page. ShowTextButtonClicked pauseBtn Pause. Select this button to pause the course. PauseButtonClicked resumeBtn Resume. Select this button to resume the course. ResumeButtonClicked previousPgBtn Back. Select this button to go to the previous screen. PreviousButtonClicked nextPgBtn Next. Select this button to go to the next screen. NextButtonClicked disaldr01_01 1 their justifications. But how do you deter and detect people like this in your organization? How do you prevent one of your subordinates and your organization from becoming the next scandal to dominate the 24-hour news cycle? How do you protect your mission? Identifying the Threat disaldr01_02 2 unexplained wealth, the unreported foreign travel, the requests for information that they do not have a need to know. Since we know what to look for, why are insider threats so difficult to identify before they cause such irreparable United States Government resource, such as personnel, facilities, information, equipment, networks, or systems, who wittingly or unwittingly causes harm to national security. Insider threat actions can result in grave unwitting insider can cause as much harm as a malicious insider, revealing sensitive information without even realizing it. Because the insider threat can be anyone in your organization, they can easily evade notice. The fact that difficult to identify these insiders, they can operate over an extended period of time, slowly stealing information and incrementally undermining the mission. Finally, due to either lack of training or reluctance to turn in their co-workers, employees tend not to report when insiders do display potential insider threat indicators. Protecting Against the Insider Threat disaldr01_03 3 So, how do you, as a senior leader, protect your organization and mission from the insider threat? Especially when it is so difficult to identify? Countering the insider threat consists of three activities: deterring people from becoming insider threats, detecting when insiders might be at malicious work, and mitigating, or controlling, the harm they can do. The success of these activities relies on the fundamentals of good security. As a senior leader, you should monitor organizational security practices. An important example would be your involvement with procedures for safeguarding classified information and applying appropriate markings to help protect organizational files and removable media. In addition to being alert to and reporting any suspicious activity, behavior, or potential security incident that you see, you must foster a culture where your employees do the same. Be sure personnel in your organization know the potential indicators and required reporting procedures. Finally, always be diligent in ensuring that you and personnel in your organization are sharing information only with those individuals who are cleared at the appropriate level and have a need-to-know. Balancing strict enforcement of need-to-know with the need for information sharing to achieve mission objectives can be challenging. Minimizing the reach of an insider is essential to mitigating the damage they can cause. Security personnel within your organization can assist you in protecting your mission and conducting this mitigate the damage insider threats cause by curtailing their reach and responding proactively to potential insider threat indicators. Insider Threat Program disaldr01_04 4 As a senior leader, you play a vital role in establishing how your organization will go about gathering, integrating, analyzing, and responding to potential insider threat information. Beyond employing general security practices, you should ensure that your agency creates a formal insider threat program. The goal of such a program is to deter, detect, and mitigate the insider threat. In October 2011, the White House issued Executive Order 13587, requiring agencies to establish their own insider threat programs. Subsequently, Presidential Memorandum Minimum Standards for Executive Branch Insider Threat Programs outlined the minimum elements needed for agencies to implement effective programs. Although current insider threat policy is specific to classified information, the principles can help you protect Senior Leader Role in an Insider Threat Program disaldr01_05 5 Other responsibilities, Other senior leader responsibilities for an insider threat program: Bullet Provide resource recommendations Bullet Submit the implementation plan and annual report Bullet Ensure proper handling and use of records Bullet Consult with legal authorities Sub Bullet Office of the General Counsel Sub Bullet Civil liberty officials Sub Bullet Privacy officials Bullet Establish guidelines for record retention Bullet Facilitate oversight reviews to ensure policy compliance [Conclusion] disaldr01_06 6