Insider Threat Awareness
Student Guide
February 2024
Center for Development of Security Excellence
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 1-1
Contents
Lesson 1: Course Introducon ................................................................................................................... 1-2
Introducon ....................................................................................................................................... 1-2
Lesson 2: Insider Threat Vulnerabilies ................................................................................................. 2-1
Introducon ....................................................................................................................................... 2-1
Denions .......................................................................................................................................... 2-2
Adversaries ......................................................................................................................................... 2-4
Insider Risk ......................................................................................................................................... 2-8
Conclusion ........................................................................................................................................ 2-11
Lesson 3: Insider Threat Indicators and Concerning Behavior ............................................................... 3-1
Introducon ....................................................................................................................................... 3-1
Risk Indicators .................................................................................................................................... 3-2
Geng Help ....................................................................................................................................... 3-9
Conclusion ........................................................................................................................................ 3-10
Lesson 4: Reporng Requirements ........................................................................................................ 4-1
Introducon ....................................................................................................................................... 4-1
Reporng Concerning Behavior ......................................................................................................... 4-1
Scenarios ............................................................................................................................................ 4-3
Conclusion .......................................................................................................................................... 4-7
Lesson 5: Course Conclusion .................................................................................................................. 5-1
Conclusion .......................................................................................................................................... 5-1
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 1-2
Lesson 1: Course Introducon
Introduction
Welcome
[Video clip, Vigilance series narrator:] Many people believe that insider threat programs are designed
to catch bad guys or spy on employees. In reality, these programs are designed to deter, detect, and
migate risk. Insider threat programs work with a muldisciplinary team of professionals, including
security, Human Resources, cyber security, mental health, legal, law enforcement and
counterintelligence to idenfy and evaluate potenally anomalous behaviors that may indicate
increased risk and recommend appropriate responses.
The goal of the program is to deter threats and detect potenal issues early on before a problem
occurs. To be sure, the risk posed by trusted insiders is real and substanal. From compromise of
classied informaon to devastang events resulng in loss of life, insider threats can have a
profound impact on naonal security. However, by working together and recognizing the signs
insider threat, programs can oen prevent these acvies by providing help and support to
employees in need, facilitang enhanced security and other countermeasures, and swily reacng to
threatening situaons. We all contribute to the ability of our insider threat programs to nd soluons
that support naonal security while protecng individual privacy and civil liberes.
How can you help?
[Course narrator:] It is up to all of us to be aware of potenal signs and report what we see. You are
your organizaon’s rst line of defense against someone who could do harm. On November 5, 2009,
Army psychiatrist Major Nidal Hasan opened red at Fort Hood, killing 13 people and injuring 30
others. Hasan exhibited signs of radicalizaon for years. On September 16, 2013, Aaron Alexis walked
into the Washington Navy Yard with a shotgun, killing 12 people and injuring 3 others. Alexis was a
former Navy reservist with a history of mental health problems. These cases inuenced the
formaon of insider threat policy.
This course will familiarize you with insider threat and provide guidance on what to do if you suspect
that something is not right.
Objectives
Welcome to the Insider Threat Awareness course. This course focuses on insider threat
vulnerabilies, potenal behaviors of concern, and reporng requirements.
Course objecves:
• Analyze a scenario and determine the vulnerabilies posed by insiders
• Analyze a scenario and recognize concerning behavior
• Analyze a scenario and apply the appropriate reporng procedures
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-1
Lesson 2: Insider Threat Vulnerabilies
Introduction
Objectives
[Vigilance Series video clip, video narrator:] Insider aacks are somemes dicult to detect,
especially since the perpetrators can be people we know and trust. Most people who become wing
or unwing insider threats don't enter the workforce with malicious intent, but over me may
experience stressors which when combined with their personal predisposions and trigger events can
lead them along a crical pathway to betrayal. Insider threat programs can play a strong role in
idenfying at-risk individuals and helping them o this pathway toward more posive outcomes, but
they can't intervene if they are not aware of the problem.
[Course narrator:] This lesson describes the vulnerabilies posed by insiders.
Lesson Objecves
• Given access and intent aributes, classify whether an individual meets the Naonal Insider
Threat Task Force (NITTF) denion for insider threat
• Given a scenario, recognize adversarial collecon techniques
• Given a descripon of predisposions, stressors, and behaviors, recognize an individual who
may pose an insider risk
Case Studies
Most insider threats do not start out as a threat; rather, they evolve into a threat over me. Consider
Major Nidal Hasan and Aaron Alexis. Major Nidal Hasan displayed concerning behaviors before he
carried out the 2009 Fort Hood shoong. Aaron Alexis had a history of mental health issues and was
involved in several violent incidents before he carried out the 2013 Washington Navy Yard shoong.
The pathway to an insider incident is oen complex. By recognizing certain risk factors along a
crical pathway, we can work to idenfy potenal threats before they escalate.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-2
Definitions
Who is An Insider?
What do we mean by insider? Consider the following. Who is considered an insider?
Select all that apply.
Sue, a cleared DOD employee
Kim, a contractor supporng a defense contract
Raj, a private sector engineer with no USG contracts married to a DOD employee
James, a volunteer supporng cleared facilies
Carlos, a civilian access control team member at a DOD facility
Lisa, a supply chain vendor for the USG
Teresa, a civilian sanitaon engineer employed at a USG facility
Insider
An insider is any person with authorized access to any United States Government resource to include
personnel, facilies, informaon, equipment, networks, or systems. This may be through
employment, a contractual relaonship, or volunteer acvies. An insider can be anyone with
access. So what makes an insider become a threat?
What is an Insider Threat?
[Mishandling video narrator:] Dave's been working on this high-prole project for a while now. He's
been pung a lot of extra hours to try to get stu done. He was already running late yesterday and
decided to take some unclassied work home. He grabbed a stack of documents and rushed out the
door in order to meet some friends for dinner. When he got home and looked through his papers, he
discovered that he accidentally grabbed some program informaon. It was a one-page document
marked SECRET SAR. Because it was so late at night, he didn't know what else to do so he decided to
shred the informaon in order to protect it.
[Course narrator:] Dave didn’t intenonally bring home a classied document. It was an accident.
Could this incident indicate an insider threat?
Select the best response.
Yes
No
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-3
Insider Threat
Insider threats can be intenonal or unintenonal.
An insider threat is the threat that an insider will use her or his authorized access, wingly or
unwingly, to do harm to the security of the United States. This can include damage through
espionage, terrorism, unauthorized disclosure, or the loss or degradaon of department resources
or capabilies.
As we saw with Dave, not all threats are deliberate acts. Unintenonal acts by insiders can pose just
as signicant a threat. A signicant poron of insider threats involve negligent or accidental
behaviors. An insider threat can occur when an individual commits a dangerous act for any number
of reasons outside of an intent to harm an organizaon.
What is Not an Insider Threat?
Consider the following scenarios. Which does NOT indicate a potenal insider threat?
Select the best response.
A scienst at a cleared facility accidentally takes home a document marked SECRET.
An employee takes a photo at their desk and posts it to social media. Documents marked
CUI are visible in the background.
An analyst has concerns about the CONFIDENTIAL informaon she’s been asked to review
and makes a protected disclosure.
None of these. They all may indicate an insider threat.
Whistleblowing
Making a protected disclosure does not indicate an insider threat.
Whistleblowing is the reporng of waste, fraud, abuse, corrupon, or dangers to public health and
safety to someone who is in the posion to recfy the wrongdoing. Employees are protected from
employer retaliaon via the Whistleblower Protecon Act and Security Execuve Agent Direcve
(SEAD) 9: Whistleblower Protecon. It is unlawful for your employer to take any acon aecng your
access to classied informaon in reprisal for making a protected disclosure. A disclosure is
protected if it meets two criteria.
• The disclosure must be based on the belief that wrongdoing has occurred.
• The disclosure must be made to a person or enty that is authorized to receive it.
Organizaons have whistleblowing policies on the correct way to report as opposed to releasing the
informaon to the media or an unauthorized source. Releasing informaon to the media or an
unauthorized source is unauthorized disclosure. It is a crime and is not whistleblowing nor applicable
to whistleblower protecons. Visit the course Resources to access the Whistleblower Protecon
Policies and FAQ Job Aid and a real life example of a case where acons were illegal and not
protected.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-4
Adversaries
Consider This
[Vigilance series, season 1, episode 2:] Rachel is sing at her computer when she receives a message
via social media oering her a job.
[Course narrator:] Rachel just received a message via social media asking her to write arcles about
travel, wine, and technology. What should she do?
Select the best response.
Be careful; it’s possible she’s being targeted.
Ask how much it pays.
What Do They Want?
Remember, not all insider threats are intenonal. It’s possible Rachel is being targeted. If she’s not
careful, an adversary could collect informaon from her, making her an unwing insider threat.
Adversaries include foreign governments, terrorist organizaons, competors, and non-state actors.
They want to know non-public informaon that an insider can provide. This includes informaon
related to:
• Personnel
• Methodologies, capabilies, and limitaons
• Facility locaons worldwide
• The countries the organizaon works with
Being aware of what adversaries want helps you protect your organizaon’s informaon.
Consider This
Consider the following scenarios. Which, if any, may indicate a threat?
Select all that apply.
Your company’s sales department receives a purchase request from an unknown vendor.
A scienst at your facility receives a request to review a research paper.
During a conference overseas, a researcher’s laptop is stolen.
As you arrive at your building early one morning, you encounter a coworker leaving the
building. The coworker nervously explains that he somemes prefers to work overnight.
Your organizaon’s network service is disrupted following a denial of service aack.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-5
Collection Methods
Any of these scenarios might point toward a possible threat.
Examining past cases reveals that adversaries commonly use certain collecon methods.
Understanding these methods can help you idenfy the presence of a threat. The most common
methods, used in over 80% of cases are:
• Requests for informaon
• Academic solicitaon
• Suspicious network acvity
• Foreign visits
• Solicitaon and markeng or seeking employment
• Targeng at conferences, convenons, and trade shows
• Elicitaon and recruitment
Visit the course Resources to access the Collecon Methods and Countermeasures Job Aid.
Requests for Information
Aempts by foreign enes to establish a connecon with a cleared contractor or employee
vulnerable to the extracon of protected informaon
Examples include, but are not limited to:
• Sales
• Representaon
• Response to tenders for technical or business services
• Requests under the guise of price quote or markeng surveys
Academic Solicitation
Aempts to acquire protected informaon under the guise of academic reasons
Examples include, but are not limited to, requests for or arrangement of:
• Peer or scienc board reviews of academic papers or presentaons
• Requests to study or consult with faculty members
• Applicaons for admission into academic instuons or programs, as faculty members,
students, fellows, or employees
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-6
Suspicious Network Activity
Aempts to carry out intrusions into cleared contractor networks and exltrate protected
informaon
Examples include, but are not limited to:
• Cyber intrusion
• Viruses
• Malware
• Backdoor aacks
• Acquision of user names and passwords
Targeting at Conferences, Conventions, and Trade Shows
Aempts to directly link programs and technologies with knowledgeable personnel
Technique:
• Technical experts may receive invitaons to share their knowledge
• Experts may be asked about restricted, proprietary, and classied informaon
Solicitation and Marketing/Seeking Employment
Aempts to place foreign personnel near cleared personnel to collect informaon and build
relaonships that may be exploited
May take many forms including:
• Joint ventures or research partnerships
• Oering of services
• Internship programs for foreign students
Foreign Visits
Aempts to gain access to and collect protected informaon that goes beyond that permied
and intended for sharing
Examples include, but are not limited to:
• Pre-arranged visits by foreign conngents
• Unannounced visits
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-7
Elicitation and Recruitment
Aempts to discreetly gather informaon that is not readily available and do so without raising
suspicion that specic facts are being sought. It is usually non-threatening, easy to disguise,
deniable, and eecve.
Examples include:
• Conversaons in person, over the phone, or in wring
• Commonly occur via social media
Threat Categories
Insider threat categories include:
• Unauthorized disclosure, which can be in the form of a leak – an intenonal, unauthorized
disclosure of classied or proprietary informaon to a person or organizaon that doesn’t
have a “need-to-know.” Unauthorized disclosure can also be unintenonal. A spill is the
unintenonal transfer of classied or proprietary informaon to unaccredited or
unauthorized systems, individuals, applicaons, or media.
• Espionage is the unauthorized transmial of classied or proprietary informaon to a
competor, foreign naon, or enty with the intent to harm.
• Sabotage is the act of deliberately destroying, damaging, or obstrucng. While sabotage is
oen conducted for polical or military advantage, personal disgruntlement may also be a
movaon.
• Targeted violence is violence directed at an individual or group for a specic reason. It
includes everything from acve shooter to harassment to workplace bullying.
While you should be aware of the various types of insider threats, know that you likely will not know
the intenon of a potenal threat. Your role is to simply report concerning behavior. Visit the course
Resources to access case studies with real life examples of unauthorized disclosure, espionage,
targeted violence, and sabotage.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-8
Insider Risk
Consider This
[Vigilance video series clip:]
Tim: I'm denitely interested. I think I can work that out and get it to you as soon as possible. Thank
you.
Susan: Hey Tim - working late again?
Tim: Hey Susan – yeah, just nished up a few things. You working late?
Susan: No, I forgot my cellphone. Got about halfway home before I realized. Can you believe that?
Me without my phone?
Tim: I know, right? Thing’s like your third hand. It’s prey late… I beer go feed the dog. Guess I lost
track of me.
Susan: I guess so... See you tomorrow, Tim.
[Course narrator:] That was an odd encounter. Susan senses that something isn’t right. What should
she do?
Select the best response.
Susan should mind her own business, get her cellphone, and go home.
Susan should run aer Tim and ask him what’s wrong.
Susan should call her coworker and ask their opinion.
Susan should talk to her supervisor about it.
Who May Pose an Insider Threat?
Susan should talk to her supervisor. Maybe Tim was just working late and maybe he needed to rush
home to feed his dog. It isn’t Susan’s job to know the full picture, and she shouldn’t speculate.
However, it is her responsibility to report concerning behavior.
There is no one type of person nor single set of circumstances that facilitates an insider act.
However, there are certain predisposions and stressors that may signal that an insider may be at
increased risk of comming a hosle act. These may make an insider more likely to act on
opportunity enabled by their access. It also may make them more suscepble to targeng or
exploitaon. Without intervenon, concerning behavior may escalate, causing potenal damage to
naonal security, personnel, facilies, or other resources.
Personal Predisposition
Predisposion refers to an individual’s personal characteriscs and circumstances that make them
more likely to engage in certain behavior. For example, looking at past insider threat cases shows
that individuals with a medical or psychiatric disorder or personality or social skills issues are more
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-9
likely to engage in risky behavior. Previous rule violaons and social network risks are also known
predisposions of those who may pose an insider threat.
Going back to the cases of Nidal Hasan and Aaron Alexis, there were several potenal predisposing
factors that may have contributed to each of their decisions to carry out their aacks. Hasan
reportedly expressed radical and extremist beliefs, including support for violent acts. He expressed
dissasfacon with his deployment to Iraq and was reportedly harassed by coworkers for his faith.
Alexis reportedly had a history of mental health issues, including paranoid delusions and hearing
voices. He also had a prior arrest for discharging a rearm in public. While the specic predisposing
factors are dierent, they may have made them more suscepble to carrying out a violent act.
Stressors
Another risk factor that may contribute to insider threat is stressors. These are events or situaons
that cause an individual to feel pressure or anxiety and may lead them to act out in ways they
normally wouldn’t. Common stressors include personal, professional, or nancial problems.
In the cases of Nidal Hasan and Aaron Alexis, each experienced several stressors. Hasan reportedly
expressed dissasfacon with his job and was disciplined for performance issues. He also faced
personal stressors and reportedly was in the process of geng divorced. Alexis reportedly had
signicant debts. He also reported feeling isolated and unsupported by his colleagues. These
stressors may have made each more suscepble to carrying out their aacks.
Concerning Behavior
Finally, concerning behavior is a potenal insider threat indicator. Concerning behaviors are
observable behaviors or acons that suggest an individual may be planning or carrying out a
malicious act. Concerning behaviors can be categorized by interpersonal behaviors such as
arguments or altercaons, technical behaviors such as conducng unauthorized computer searches,
security behaviors such as failing to follow procedures, and nancial behaviors such as unexplained
large purchases.
Both Hasan and Alexis displayed concerning behaviors that may have indicated their intenons. Prior
to the aack on Fort Hood, Hasan communicated with an operave from a terrorist organizaon. He
researched ways to kill large numbers of people. He also displayed errac behavior, such as giving
away his possessions and preparing his apartment for his departure. Aaron Alexis also displayed
several concerning behaviors before carrying out the aack on the Navy Yard. He complained he was
being followed by people who were sending vibraons into his body. He was involved in altercaons
with several people. Two days before the aack, he pracced shoong at a gun range. Taken
together, the concerning behaviors of both Hasan and Alexis suggest they were each experiencing
signicant issues and were exhibing signs of increased risk for potenal violence.
Problematic Organizational Response
Finally, problemac organizaonal response is a potenal insider threat indicator. Inadequate
organizaonal responses can escalate the acons of at-risk employees who are more likely to plan
and execute aacks. Examples of problemac organizaonal responses include inaenon, not
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-10
having a risk assessment process, inadequate invesgaon, and other acons that escalate risk. For
example, in studying past insider threat cases, in many cases there was insucient concern prior to
the incident. In addion, there was not an organizaonal mechanism to organize and communicate
potenal threat informaon to the appropriate security ocials to prevent, deter, detect, or migate
malicious acons.
The cases of both Hasan and Alexis were integral to establishing policies to develop Insider Threat
Programs and guidelines for informaon sharing between organizaons and program pillars. These
policies are essenal to protect classied informaon and strengthen naonal security.
Consider This
[Vigilance video series clip:]
Montenegro: Sorry to hear about you and Sarah spling and calling o the engagement. That's
tough.
Tim: Yeah, but hey…this sure is helping. (Shows Montenegro a picture of his new sports car.)
Montenegro: Whoa, man. That is awesome. Let me see?
Tim: Just picked it up yesterday.
Montenegro: Wow, this is a big step up from your Corolla, bro. That must have set you back a couple
bucks.
Tim: Yeah, well…I was shopping for a new car and I gured, why not?
Montenegro: Yeah man, if I came home with something like that, my wife would kill me! You'd be
vising me in the hospital, brother.
Tim: Hey man, you only live once. Somemes you got to do what you got to do. Listen, I was thinking
I’ll probably give my two weeks’ noce today.
Montenegro: Really? What's going on?
Tim: You know I didn't get the lead programmer posion I wanted, right?
Montenegro: Yeah, I heard. That sucks, you should have goen it.
Tim: I worked my bu o for that job and I really, really needed the money. But it's all good. I gured
I might move across the country, Seale maybe. Be nice to get a road trip with the new
wheels…some fresh air.
Montenegro: Wow, are you serious? I mean, there's bound to be other opportunies around here. I
mean…hey listen, if this is about Sara, there's plenty of other sh in the sea. You know we'll miss you
around here, but hey – Seale? A road trip in a car like that? All sounds prey good.
Tim: Montenegro, do me a solid don't talk to anyone about this yet because a chance to talk it over
with HR rst. Thanks.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 2-11
[Course narrator:] What potenal risk indicators did Major Montenegro see in Tim’s behavior?
Select all that apply.
Personal issues: His engagement was called o.
Professional issues: He didn’t get the promoon he wanted.
Financial issues: He purchased sports car.
None; he just has a lot going on in his life.
Debrief
While there may be a logical explanaon, Tim is displaying indicators of personal, professional, and
nancial issues that could indicate an insider threat.
[Vigilance Series video clip, video narrator:] Major Montenegro is a good friend to Tim. Despite Tim's
excitement over his new car, he was able to pick up on some obvious stress and dissasfacon in
Tim's life. While this is nothing unusual, we’re all human - it's important to note that many of these
normal stressors can lead to negave consequences if not resolved. Reporng this informaon to a
supervisor, human resources, or directly to the insider threat program is a great way to ensure that
Tim’s situaon is evaluated fairly and quickly - whether Tim poses a threat, is at increased risk for
targeng or recruitment by an adversary, or simply needs a lile help to work through a dicult
me. The insider threat program can nd a soluon that manages insider risk, maintains Tim's
privacy, and protects naonal security.
Conclusion
Summary
You have completed the Insider Threat Vulnerabilies lesson.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-1
Lesson 3: Insider Threat Indicators and Concerning Behavior
Introduction
Objectives
[Vigilance series narrator:] Insider threats come in many forms including sabotage, fraud, the,
workplace violence, unauthorized disclosure, and compromises of classied informaon. The
compromise of classied informaon can be unintenonal - the result of careless security pracces or
an intenonal act perpetrated by an individual working alone or on behalf of an adversary.
Foreign intelligence enes are known to target and recruit trusted insiders as a means of collecng
protected data. In addion, many insiders unwingly place classied informaon at risk by sharing it
with individuals without a need to know. Aempng to access or collect informaon without
authorizaon is a reportable potenal risk indicator of insider threat. Would you recognize it if you
saw it? Would you know what to do?
[Course narrator:] This lesson describes insider threat indicators and concerning behaviors.
Lesson Objecves
• Given a scenario, idenfy reportable behavior indicators
• Given a scenario, recognize the role of Employee Assistance Programs in migang potenal
threat
Case Studies
Insider threats do not need to hold a high rank or posion to inict grave damage. This is in part due
to technology that empowers individuals at all levels. Today it is possible for one person, regardless
of rank or posion in the organizaon, to do a lot of damage.
Jonathon Toebbe, a U.S. Navy engineer, was sentenced to 18 years for aempng to use his access
to sell sensive nuclear submarine secrets. Harold Marn III, a defense contractor, was sentenced to
9 years for stealing 50 terabytes of classied informaon. Christopher Paul Hasson, a former U.S.
Coast Guard ocer, was sentenced to more than 13 years for federal weapons and drug crimes
related to plong violent aacks.
The pathway to an insider incident is oen complex. By recognizing insider threat indicators and
concerning behaviors, we can work to idenfy potenal threats before they escalate.
To learn more, visit the course Resources to access case studies about Toebbe, Marn, and Hasson.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-2
Risk Indicators
Consider This
[Clip from Vigilance video series, season 1, episode 3:]
Joyce: That's it! See you next week.
Phyllis: The new milestones on this project are impossible!
Joyce: I know, right? Aer this project is nished, I'm gonna need a long holiday weekend on a
tropical beach with some tropical sun and some tropical drinks.
Stewart: I need that travel agent!
Phyllis: Yeah well, I don't think anyone's going on holiday for a while. My problem is I sll don't have
access to the les on the server like your team does. It would make my life a whole lot easier. I know
if I just had some pieces of the source code I need, I could easily make my review date.
Joyce: You're probably right, but you need to talk to Mark about that, Phyllis. A couple weeks ago, I
needed some extra informaon for an arcle I was publishing in a defense journal. Since he was my
supervisor, he hooked me up.
Phyllis: I tried. He doesn't understand. I don't think he ever sees the big picture. I mean, we're all on
the same team, right?
Joyce: As far as I know.
Phyllis: Well, if you could do anything to help me out, I'd really appreciate it.
[Transions to Phyllis alone in the break room, Stewart overhears her on the phone.]
Phyllis: Yes, okay tomorrow sounds ne. Same ight as last me. Yes, I had plenty of me in London
to connect to Cyprus. No, thank you. I have someone picking me up.
[Course narrator:] Do you think Phyllis exhibits any potenal risk indicators?
Select the best response.
No; it looks like she’s just trying to do her job.
Yes; she has a lot going on and her behavior is concerning.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-3
Risk Categories
Phyllis exhibits potenal risk indicators. While it’s not your responsibility to know specically what is
going on, you do need to recognize potenal risk indicators.
Christopher Hasson, a former U.S. Coast Guard ocer, is a real-life insider threat whose arrest
possibly prevented acts of violence. He was found guilty of federal weapons and drug crimes.
Hasson’s posion in the Coast Guard gave him access to informaon and facilies. Hasson held
extremist views and used his government computer to research violent aacks, including the
Unabomber’s aacks and manifesto. In addion, Hasson stockpiled assault weapons and opioids.
Risk looks dierent across organizaons. In addion to these categories, risk can generally be
delineated as:
• Financial consideraons
• Foreign consideraons
• Professional performance
• Psychological condions
• Security or compliance issues
Access Attributes
Include, but are not limited to:
• Security clearance and informaon access
• Access to physical facilies
• Access to systems and applicaons
• DOD system(s) privileged user
• Explosives access or training
Violent Extremist Mobilization
Includes, but is not limited to:
• Engaging in or conspiring to engage in violent extremist acvies
• Communicang with foreign terrorist organizaon
• Conducng an aack
• Traveling overseas to join a foreign terrorist organizaon
Technical Activity
Includes, but is not limited to:
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-4
• Violang informaon system policies
• Suspicious email or browsing acvity
• Transferring data to personal or suspicious account
• Tampering with record-keeping data
• Introducing malicious code
Criminal/Violent Conduct
Includes, but is not limited to:
• Exhibing or threatening violence
• Weapon mishandling
• Failure to follow court order
• Parole or probaon violaon
• Criminal aliaons
• Suicidal ideaon or aempt
Substance Abuse
Include, but are not limited to:
• Illegal substance use or tracking
• Legal substance abuse or tracking
• Treatment for abuse of drugs, alcohol, or controlled substances
Financial Considerations
Include, but are not limited to:
• Financial crime
• Filing for bankruptcy
• Delinquent debts
• High debt-to-income rao
• Failure to le tax returns
• Displaying signs of unexplained auence
• Gambling problem
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-5
Foreign Considerations
Include, but are not limited to:
• Cizenship
• Foreign travel to countries of concern
• Frequent foreign travel excluding ocial travel
• Foreign military or government service
• Possessing foreign passport
• Possession of foreign assets
• Unauthorized contact with a foreign intelligence enty (FIE)
Professional Performance
Includes, but is not limited to:
• Declining performance rangs
• Poor performance
• Reprimand/non-judicial punishment
• Human Resources (HR) complaints
• Demoon
• Suspension
• Negave characterizaon of previous employment or service
Psychological Conditions
Include, but are not limited to:
• An-social or compulsive behavior
• Communicang endorsement of workplace violence
• Mental instability
• Admission to inpaent mental health facility
• Past untruthfulness
Security/Compliance Incidents
Include, but are not limited to:
• Compliance violaon
• Security infracon
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-6
• Security violaon
• Non-compliance with training requirements
• Time entry violaons
• Security clearance denial, suspension, or revocaon
Consider This
[Clip from Vigilance series, season 2, episode 2:]
Trish: Hey, Rachel.
Rachel: Oh hi, Trish.
Trish: Some of us are going across the street for some drinks. Come join us!
Rachel: Oh, I'd love to but I'm sll trying to nish some work here. With all those contractors leaving,
it's like a ghost town over there.
Trish: How did you get approved for overme?
Rachel: (Grimaces) I didn't, but I sll have some work to nish. It's okay, I'll just be a few minutes. Go
on, I'll meet you over there.
Trish: All righty.
Rachel: Oh hey, Trish? Can you do me a favor? You're the weapons systems analyst, yes? Could you
get me the most recent tech les? You know, please? There could be something in there. I know
they’re rough dras, but there may be something in there that could help me nish my own work and
then we can all move on.
Trish: Rachel, I've already locked my les for the day…but I guess I can check with my supervisor
tomorrow.
Rachel: Never mind, it's okay. I'll just keep slogging on here. Thanks anyway.
(Trish walks away.)
Rachel (talking to herself): CRAP!
[Course narrator:] Did you noce any potenal risk indicators?
Select all that apply.
Trish asking Rachel to meet the team for drinks.
Trish not helping Rachel by sharing her les.
Rachel asking Trish for access to her les.
Rachel working outside of normal business hours.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-7
Reportable Behavior Indicators
Changing work habits and seeking access to classied informaon without a “need-to-know” are
both reportable behavior indicators.
Jonathan Toebbe is a real-life insider threat who aempted to sell restricted data. He went to great
lengths to avoid detecon, but ulmately was unable to hide his acvies. He smuggled restricted
data past security checkpoints a few pages at me over several years – violang security procedures
and protocols and, certainly, comming unauthorized removal. He was paid $100,000 in
cryptocurrency by FBI agents posing as conspirators.
In addion to these indicators, many known insider threats have been associated with one or more
of the following reportable indicators of concerning behavior -
• Signicant changes in personality, behavior, or work habits
• Substance abuse or addicve behaviors
• Disgruntled to the point of wanng to retaliate
• Access to facilies and/or proprietary informaon outside of normal work hours
• Seeking classied or proprietary informaon, systems, or technology without a “need-to-
know”
For covered individuals requiring naonal security eligibility, these behaviors are ed to the
adjudicave guidelines and are required to be reported.
Term
Supplemental Material
Adjudicave
Guidelines
Guideline A: Allegiance to the United States
Guideline B: Foreign Inuence
Guideline C: Foreign Preference
Guideline D: Sexual Behavior
Guideline E: Personal Conduct
Guideline F: Financial Consideraons
Guideline G: Alcohol Consumpon
Guideline H: Drug Involvement and Substance Misuse
Guideline I: Psychological Condions
Guideline J: Criminal Conduct
Guideline K: Handling Protected Informaon
Guideline L: Outside Acvies
Guideline M: Use of Informaon Technology
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-8
Consider This
[Clip from Vigilance video series, season 1, episode 3:]
[No dialog - Stewart observes Phyllis looking over Joyce’s shoulder at Joyce’s computer screen.]
Stewart: I’m going to the breakroom.
[No dialog - Stewart observes Phyllis removing a thumb drive from a computer.]
[Course Narrator:] Now what is Phyllis up to?
Does Phyllis exhibit any potenally concerning behavior?
Select all that apply.
Looking at her co-worker’s computer over her shoulder
Not going to the break room when Stewart said he was going
Using a ash drive
Being in a bad mood and not being a team player
Technology-Related Indicators
There may be a logical explanaon, but Phyllis’ behavior is concerning. Remember, it is your
responsibility to be aware of concerning behavior. It is not up to you to speculate if it may indicate an
actual threat.
Real-life insider threat Harold Marn III used his posion as a contractor to steal terabytes of
classied data over 30 years. Clearly, he must have displayed some concerning behavior over that
me. Improper use of privileged access, hoarding, and knowingly bypassing protocols are all
reportable technology-related behaviors.
Many known insider threats have been associated with one or more of these and the following
technology-related indicators:
• Working odd hours without authorizaon
• Inappropriate copying of classied or proprietary informaon
• Requests for technical or program access beyond scope of work
• Introducon of unauthorized technical devices into the workplace
• Keeping unauthorized backups
• Unauthorized requests for, use of, or removal of technical equipment
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-9
Getting Help
Consider This
[Clip from Vigilance series, season 2, episode 2:]
News broadcast: In other news from Washington, the federal government has announced a new
round of budget cuts that could impact a number of government agencies.
Government supervisor: There'll be no more overme for federal employees and no performance
bonuses unl further noce.
Carmen: Our contract ends in two months. I'm sorry to have to tell you that we have received ocial
government nocaon that it will not be renewed.
Antonio (talking to himself at his desk): I've only found two job possibilies in three weeks and
neither of them come close to paying me what I was making here. I just hope and pray we don't have
to sell the house and move and start all over again.
Carmen: Good morning, Antonio.
Antonio: What's up?
Carmen: Well, I was wondering where you were this morning.
Antonio: What do you mean? I was here at my desk!
Carmen: Well, you weren't at the Monday team meeng again.
Antonio: Huh, oh yeah. Guess I forgot. Anyway, I don't know what dierence it makes at this point. I
mean, why bother?
Carmen: Well, we sll have to nish as much of the nal schemacs as we can and a rough outline
for going forward.
Antonio: Going forward? For what?! To unemployment?! I mean, to be honest with you, Carmen… if I
had any more sick leave or paid me o I’d just take it, but I guess I could work on it a bit more.
Carmen: We're all bummed about this, but we sll have to as much as we…
Antonio: Hey, I said I would work on it, okay?!
[Course narrator:] That didn’t go very well. Antonio is clearly stressed. What should Carmen do?
Select the best response.
She should mind her own business; he’s just having a bad day.
He’s clearly having a hard me. She should get him some help.
Even though the contract is almost up, she should re Antonio.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 3-10
Employee Assistance Programs
Yes, Antonio might need some extra help.
If you or a colleague are experiencing stress, emoonal problems, or nancial dicules, do not
allow the situaon to go unresolved; there are resources that can help you address the problem. The
Employee Assistance Program (EAP) is designed to help employees navigate these issues. Employees
and supervisors are encouraged to call at the rst sign of a developing problem. Early assistance can
prevent readily solvable problems from developing into major issues. Check your internal
organizaon website for informaon on how to contact your EAP and nd out what services they
oer.
Debrief
[Vigilance series clip, narrator:] People who exhibit concerning behaviors are not always bad people.
They may not necessarily be doing something wrong. Somemes stressors build up over me and
that can lead to troubling behavior. Most insider threats exhibit risky behavior prior to comming
negave workplace events.
Conclusion
Summary
You have completed the Insider Threat Indicators and Concerning Behaviors lesson.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-1
Lesson 4: Reporng Requirements
Introduction
Objectives
[Vigilance Series Video Narrator:] Co-workers, supervisors, and managers are oen the rst to sense
that an individual is experiencing stress or personal issues. Many of us may be hesitant to report this
informaon. Aer all, everyone has stressful life experiences or has a bad day occasionally. No one
wants to cause trouble for a friend or co-worker or be thought of as crying wolf over nothing.
Consider though that insider threat programs are muldisciplinary in nature and designed to
evaluate the enrety of the situaon and can oen put reported indicators in context. They treat
each maer individually with utmost respect for privacy and civil liberes. Migaon response
opons oen include soluons that provide help and resources for those in need. We all have a duty
to report indicators. Being nervous about it is natural but consider the consequences of not reporng.
How can you help your fellow employees while fullling your security responsibilies?
[Course narrator:] This lesson describes insider threat reporng procedures.
Lesson Objecves
• Given a scenario, recognize the role all employees play in ensuring an organizaon’s security
• Given a scenario, idenfy to whom to report concerning behavior
Reporting Concerning Behavior
Roles and Responsibilities
[Clip from Vigilance series, Season 2, Episode 3 Video narrator:] Reporng can be dicult for
employees, but coworkers are right to do so. Employees of cleared industry and federal agencies
must report potenal threats. Early reporng allows insider threat programs to pursue a
muldisciplinary approach to gathering and reviewing informaon.
[Course narrator:] Security is the responsibility of everyone in an organizaon. Employees are the
rst line of defense against insider threats and are responsible for reporng concerning behavior.
While all employees are responsible for reporng concerning behavior, organizaons also have
specic teams and individual roles in place to protect against insider threats.
• The Insider Threat Program addresses and analyzes informaon from mulple sources
regarding concerning behaviors and any risks that could potenally harm an organizaon.
• The Insider Threat Program Senior Ocial implements Insider Threat Program acvies,
including daily operaons, management, and ensuring standards compliance.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-2
• The Facility Security Ocer (FSO) is in charge of managing security in their organizaon’s
facilies.
• An organizaon’s leadership promotes a protecve and supporve culture throughout the
organizaon in support of employees and the organizaon’s Insider Threat Program.
Obligations
Reporng foreign collecon aempts is required by both DODD 5240.06 and the Naonal Industrial
Security Program Operang Manual (NISPOM). Who you report to depends on if you are a DOD,
cleared industry, or federal agency employee.
• DOD employees: Report potenal threats to your organizaon’s Insider Threat Program
• Cleared industry employees: Report to the facility Insider Threat Program Senior Ocial
(ITPSO) or Facility Security Ocer (FSO)
• Federal agency employees: Report to your agency’s Insider Threat Program, security oce,
or supervisor
Failure to report can result in nes, prison, or both. Specic reporng procedures vary, follow your
organizaon’s reporng procedures.
What to Report
If you suspect a possible threat, you must report it. You cannot assume anyone else will do so.
Specically, all employees must report personal foreign travel (including to Canada), personal foreign
contacts, outside acvies (speeches, books, manuscripts) involving the Intelligence Community, and
eorts by anyone (regardless of naonality) to obtain illegal or unauthorized access to classied or
proprietary informaon or to compromise a cleared employee. Finally, all employees must report
contacts by cleared employees with known or suspected intelligence ocers from any country, or
any contact which suggests the employee may be the target of an aempted exploitaon by the
intelligence service of another country.
Contractors have addional requirements, and there are specic requirements for reports submied
to the FBI.
Additional Contractor Requirements
Contractors are required to report events that impact:
• The status of the facility
• The status of an individual’s personnel security clearance
• Anything that aects the proper safeguarding of classied/proprietary informaon
• Indicaons that classied/proprietary informaon has been lost or compromised
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-3
Reports Submitted to the FBI and DCSA
Reports to be submied to the FBI by the appropriate security ocial:
• The contractor shall promptly submit a wrien report to the Defense
Counterintelligence and Security Agency and the nearest eld oce of the FBI regarding
informaon coming to the contractor’s aenon concerning actual, probable, or
possible:
o Espionage
o Sabotage
o Terrorism
o Subversive acvies
Scenarios
Overview
Earlier in this course, you met Tim, Rachel, and Phyllis. Let’s review a brieng for each and explore
what, if anything, should be reported and to whom.
Rachel:
• Targeted on social media
• Worked late without approval
• Asked coworker for les
Tim:
• Personal stressors
• Professional stressors
• Financial stressors
Phyllis:
• Seeking informaon without approval
• Unauthorized use of ash drive
• Foreign travel
Rachel: Briefing
Rachel is a federal government employee who was contacted via social media.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-4
Since receiving the rst message on social media, Rachel has received more messages asking
increasingly detailed quesons about her work. What should she do?
Select the best response.
Answer their quesons
Ignore then sender and block them
Self-report
Rachel: Feedback
Rachel needs to self-report the contact. People are targeted this way all the me.
In 2018, Henry Kyle Frese was contacted by a journalist via Twier direct message. He failed to
report the journalist’s suspicious requests for naonal defense informaon. Instead, he accessed
informaon outside the scope of his job dues. For over a year, Frese passed classied informaon
to journalists and a potenal romanc partner for personal gain. He was arrested in the fall of 2019
and was sentenced to 30 months in prison for the unauthorized disclosure of classied naonal
defense informaon to two journalists. To learn more, visit the course Resources to access a case
study about Frese.
Rachel: Reporting
Rachel knows she must self-report the unsolicited messages she received via social media. To whom
should she report?
Select the best response.
Report to her organizaon’s Insider Threat Program, security oce, or her supervisor.
Report to the media so they can warn the general public.
Report to her co-workers and her network provider.
Feedback: As a Federal employee, Rachel must report to her organizaon’s Insider Threat Program,
security ocer, or her supervisor. If her co-workers are aware she was contacted, they are also
required to report it.
Tim: Briefing
Tim is a DOD employee. His coworker Maj. Montenegro is concerned about him. Tim is exhibing
several potenal risk indicators.
What should Maj. Montenegro do?
Select all that apply.
Don’t report it; it’s not his responsibility because it doesn’t pose an imminent threat.
Don’t report it; it’s not his responsibility because he doesn’t think it involves a foreign enty.
Report it; it’s everyone’s responsibility to report concerning behavior.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-5
Tim: Feedback
Major Montenegro needs to report the concerning behavior so that it can be evaluated. It’s likely
Tim just needs some help and to be referred to his organizaon’s Employee Assistance Program.
Reporng helps people o a potenal crical path to a more posive outcome.
Tim: Reporting
To whom should Maj. Montenegro report Tim’s concerning behavior?
Select the best response.
His supervisor
His organizaon’s Insider Threat Program
His security oce
Feedback: DOD reporng procedures state to report to the organizaon’s Insider Threat Program.
[Vigilance video series clip]
Major Montenegro: Anyway, Marc, I just thought you should know what happened. Tim's a really
good guy. I have known him for about three years now. We played soball together. We've gone to
some concerts and stu. He didn't get the lead programming posion that he wanted and then he
broke up with his ancée. I know he's had some nancial problems and lately he's been working
some crazy hours. He's been really down. I really liked him, but I thought I should just report what
happened yesterday. Maybe you can cut him some slack?
Marc: Thanks, Major. I know you liked him. In fact, we all do that's why I'm so happy you came in to
talk to me today. Tim may be having some problems, but he's sll a valued employee that we want to
help out during periods of stress or transion. Our agency has so many resources available to folks
whether they're struggling personally, professionally, or nancially - most people don't even realize
that. Anyway, I will work with the insider threat team to assess the situaon.
Major Montenegro: Insider threat? Wait a minute, I don't want to get Tim in any trouble.
Marc: The insider threat team isn't there to get anyone in trouble and we work together all the me
to improve security pracces, increase awareness, and idenfy employees who may be at risk. Most
of the me we're able to resolve issues swily. Don't worry. Tim's in good hands and you did the right
thing by coming to me. But please, let's keep this between us. I don't want anyone to start rumors
about Tim
Major Montenegro: Yes, sir. Thank you.
Phyllis: Briefing
Phyllis is an employee of a cleared defense contractor. Her coworkers have noced several suspicious
behaviors from her.
What concerning behavior should Phyllis’ coworkers report?
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-6
Select all that apply.
Studying her co-worker’s computer screen over her shoulder
Using a ash drive
Asking her coworkers for the source code aer the supervisor denied her request
Traveling travel to London and Cyprus without self-reporng
Phyllis: Feedback
All of these behaviors are concerning and should be reported by her coworkers.
In the rst example, Phyllis is aempng to covertly look at informaon on her co-worker’s
computer. Maybe she’s just being nosey, but without a need-to-know she shouldn’t be looking at all.
Anyone observing such behavior is required to report it. Removable storage devices should not be
connected to computers within a protected network unless prior approval has been granted. Seeking
to work around a supervisor’s denial of access to classied informaon must also be reported.
Finally, while there’s nothing wrong with traveling out of the country, persons with access to
classied informaon are required to self-report when they plan to travel overseas. Failing to do so
must also be reported.
Daniel Hale is a real-life insider threat. He was a DOD contractor who used technology to exltrate
naonal defense informaon. He purposefully disregarded the law and passed classied informaon
to journalists. Hale’s disclosure of classied documents resulted in the documents being published
and available for public view, to include by adversaries. Their disclosure could cause exceponally
grave damage to the United States. Hale pleaded guilty to retenon and transmission of naonal
defense informaon and was sentenced to 45 months in prison.
To learn more, visit the course Resources to access a case study about Hale.
Phyllis: Reporting
To whom should Phyllis’ coworkers report Phyllis’ concerning behavior?
Select all that apply.
Report to Phyllis’ supervisor.
Report to the facility Insider Threat Program Senior Ocial (ITPSO) or Facility Security Ocer
(FSO).
Report directly to the FBI.
Feedback: The 32 CFR Part 117 NISPOM Rule states that contractors must report to their facility
Insider Threat Program Senior Ocial (ITPSO) or Facility Security Ocer (FSO).
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 4-7
Wrap Up
[Vigilance narrator:] The risk posed by trusted insiders is real and substanal. From compromise of
classied informaon to devastang events resulng in loss of life, insider threats can have a
profound impact on naonal security.
[News announcer:] In Washington today, Applied Technologies conrmed an unauthorized disclosure
of informaon that could compromise the latest US drone avionics program and naonal security.
[Course narrator:] We are all responsible for security. If you encounter concerning behavior, you
must report it.
Conclusion
Summary
You have completed the Reporng Requirements lesson.
Insider Threat Awareness Student Guide
February 2024 Center for Development of Security Excellence Page 5-1
Lesson 5: Course Conclusion
Conclusion
Summary
This course familiarized you with insider threat and provided guidance on what to do if you suspect
that something is not right. It is up to all of us to be aware of potenal signs and report what we see.
You are your organizaon’s rst line of defense against someone who could do harm.
Conclusion
Congratulaons! You have completed the Insider Threat Awareness course.
You should now be able to perform all of the listed acvies.
• Analyze a scenario and determine the vulnerabilies posed by insiders
• Analyze a scenario and recognize concerning behavior
• Analyze a scenario and apply the appropriate reporng procedures
To receive course credit, you must take the Insider Threat Awareness examinaon. Please use the
Security Training, Educaon, and Professionalizaon Portal (STEPP) system from the Center for
Development of Security Excellence to access for the online exam.
