The Insider Threat: Behavioral indicators and factors influencing likelihood of intervention

TY - JOUR

T1 - The Insider Threat

T2 - Behavioral indicators and factors influencing likelihood of intervention

AU - Bell, Alison J C

AU - Rogers, M. Brooke

AU - Pearce, Julia M

PY - 2019/7/1

Y1 - 2019/7/1

N2 - The insider threat is a significant security concern for Critical National Infrastructure (CNI) organizations. A successful insider act in one of the CNI sectors has potential to damage assets and interrupt the critical services that society depends upon. Existing research suggests that behavioral indicators are often evident prior to an act taking place, but that reporting of such behaviors does not usually happen. The aim of this study was to identify factors that influence employees’ intention to intervene when observing behavioral changes associated with insider acts. An online survey with employees within a large Critical National Infrastructure (CNI) energy sector organization (N=55) explored factors including behavioral change type, relationship to the actor, employment status of the actor and actor motivations. Results supported existing research regarding reluctance to report behavioral indicators of attitude change, but also demonstrated that situations with sufficient evidence are more likely to be reported. Factors which inhibited intervention likelihood were relative seniority and perceived motivations of the actor, confidence of confidentiality and clarity of reporting processes. Primary barriers to intervention related to the observer's perceived ability to correctly interpret behavioral indicators and awareness of how to respond. Organizations need to provide training regarding behavioral indictors of insider threats, clear, confidential reporting processes, and a culture where respectful challenge is encouraged.

AB - The insider threat is a significant security concern for Critical National Infrastructure (CNI) organizations. A successful insider act in one of the CNI sectors has potential to damage assets and interrupt the critical services that society depends upon. Existing research suggests that behavioral indicators are often evident prior to an act taking place, but that reporting of such behaviors does not usually happen. The aim of this study was to identify factors that influence employees’ intention to intervene when observing behavioral changes associated with insider acts. An online survey with employees within a large Critical National Infrastructure (CNI) energy sector organization (N=55) explored factors including behavioral change type, relationship to the actor, employment status of the actor and actor motivations. Results supported existing research regarding reluctance to report behavioral indicators of attitude change, but also demonstrated that situations with sufficient evidence are more likely to be reported. Factors which inhibited intervention likelihood were relative seniority and perceived motivations of the actor, confidence of confidentiality and clarity of reporting processes. Primary barriers to intervention related to the observer's perceived ability to correctly interpret behavioral indicators and awareness of how to respond. Organizations need to provide training regarding behavioral indictors of insider threats, clear, confidential reporting processes, and a culture where respectful challenge is encouraged.

KW - Insider threat

KW - Bystander intervention

KW - Counterproductive workplace behavior

KW - Behavioral indicators

KW - Reporting

U2 - 10.1016/j.ijcip.2018.12.001

DO - 10.1016/j.ijcip.2018.12.001

M3 - Article

SN - 1874-5482

VL - 24

SP - 166

EP - 176

JO - International Journal of Critical Infrastructure Protection

JF - International Journal of Critical Infrastructure Protection

ER -