The insider threat: Behavioral indicators and factors influencing likelihood of intervention

Abstract

The insider threat is a significant security concern for Critical National Infrastructure (CNI) organizations. A successful insider act in one of the CNI sectors has potential to damage assets and interrupt the critical services that society depends upon. Existing research suggests that behavioral indicators are often evident prior to an act taking place, but that reporting of such behaviors does not usually happen. The aim of this study was to identify factors that influence employees’ intention to intervene when observing behavioral changes associated with insider acts. An online survey with employees within a large Critical National Infrastructure (CNI) energy sector organization (N = 55) explored factors including behavioral change type, relationship to the actor, employment status of the actor and actor motivations. Results supported existing research regarding reluctance to report behavioral indicators of attitude change, but also demonstrated that situations with sufficient evidence are more likely to be reported. Factors which inhibited intervention likelihood were relative seniority and perceived motivations of the actor, confidence of confidentiality and clarity of reporting processes. Primary barriers to intervention related to the observer's perceived ability to correctly interpret behavioral indicators and awareness of how to respond. Organizations need to provide training regarding behavioral indictors of insider threats, clear, confidential reporting processes, and a culture where respectful challenge is encouraged.