Most insider threats exhibit risky behavior prior to committing negative workplace events. Not all these risk indicators will be evident in every insider threat, and not everyone who exhibits these behaviors is doing something wrong. However, most insider threats have displayed at least some of the potential risk indicators. If identified early, many risks can be mitigated before harm to the organization, other employees or the United States occurs.
Access — Someone has a security clearance and information access, access to physical facilities, access to systems and applications, or has explosives or CBRN (Chemical, biological, radiological, and nuclear defense) access or training.
Criminal/violent conduct — Someone demonstrates criminal violent behavior, to include sexual assault and domestic violence or other criminal behavior, exhibiting violence at work, threatening violence, possessing an unauthorized weapon, possessing an authorized weapon at an unauthorized time or location, parole or probation or violation, criminal affiliations, self — harm, suicidal ideation, or attempting suicide.
Financial considerations — Someone who has committed a financial crime, has filed for bankruptcy, foreclosure or repossession, loan default, high debt — to — income ratio, failure to file tax returns, pay garnishment, displaying signs of unexplained affluence, or has experienced a gambling problem.
Foreign considerations — Someone with foreign citizenship, foreign travel to countries of concern, frequent foreign travel, service in foreign military or government, possessing foreign passport, voting in foreign election, possession of foreign assets, foreign residency, foreign business or political interest.
Professional performance — Someone with declining/poor performance ratings, reprimand/non — judicial punishment, Human Resources (HR) complaints, demotion, separation status, suspension, involuntary administrative leave, leave of absence, unauthorized absence/AWOL
Psychological conditions — Someone who has falsified hiring information, falsified data at work, is subject to judgement in civil litigation, has expressed ill — will towards the U.S. government or his/her employer, communicated extremist views, associates with extremist or terrorist groups, has been admitted to an inpatient mental health facility, displays anti — social or compulsive behavior, mental instability, past untruthfulness, or has communicated endorsement of workplace violence.
Security/Compliance Incidents — Someone who has incurred compliance violations, security infraction/ violations, non — compliance with training requirements, misuse of DoD purchase card or expense violations, time entry violations, security clearance denial, suspension, or revocation.
Substance abuse — Someone who engages in illegal substance use or trafficking, legal substance abuse or trafficking — alcohol or prescription drugs — voluntary or involuntary treatment for abuse of drugs, alcohol, or controlled substances.
Technical activity — Someone who violates acceptable user or other automated information system policies, displays suspicious or unauthorized email or browsing activity, attempts to introduce an unapproved USB device, is linked to an unusual volume of data transferred to removable media inserted in USB port, attempts to burn discs without authorization, transfers data to personal or suspicious account, erases, modifies, or tampers with any record — keeping data, introduces unauthorized software, attempts modification to registry or system settings, disables anti — virus or firewall settings, or introduces malicious code.
Violent Extremist Mobilization — Someone who engages in, or conspires to engage in violent extremist activities, such as conducting an attack or traveling overseas to join a foreign terrorist organization.
Source: Center for Development of Security Excellence
