Why National Insider Threat Awareness Month Matters to SMBs

September has been deemed National Insider Threat Awareness Month by the National Counterintelligence and Security Center (NCSC) and the National Insider Threat Task Force (NITTF) in partnership with federal agencies across the government.

Launched in September 2019, the goal of this annual campaign is to

• educate federal employees, private sector stakeholders, and other audiences about the serious risks posed by insider threats,
• encourage employees to recognize and report anomalous activities so early intervention can occur, and
• lead to positive outcomes for at-risk individuals and reduced risks to organizations.

What is an Insider Threat?

An insider threat is a security risk to an organization that comes from within the business itself. It may originate with current or former employees, contractors, or any other business associates that have – or have had – access to an organization’s data and computer systems. And it doesn’t always have to be malicious.

“All organizations are vulnerable to insider threats from employees who may use their authorized access to facilities, personnel or information to harm their organizations — intentionally or unintentionally,” said NCSC Director William Evanina. “The harm can range from negligence, such as failing to secure data or clicking on a spear-phishing link, to malicious activities like theft, sabotage, espionage, unauthorized disclosure of classified information, or even violence.”

What is the Risk of Insider Threats to SMBs?

Obviously, this campaign, organized by federal agencies, focuses on threats to national security. And you may think, “My Low Country business has nothing to do with foreign countries, national contracts, or classified information.” Okay. But what about your vendors? Or companies you partner with in some way?

> Your business could be a gateway into other businesses that you share information with or have allowed access to your network. And vice versa.

> Your employees could have spouses or family members being targeted for any number of reasons.

The following examples of recent arrests and prosecutions from the 2020 NCSC press release underscore the risks posed by insider threats to government agencies, businesses, research facilities, and universities.

• On August 21, 2020, an individual was arrested for conspiring to provide Russia with classified information, including while he served in the U.S. Army Special Forces.
• On August 14, 2020, an individual was arrested for conspiring to provide China with classified information, including while he worked as a contract linguist for the FBI.
• On July 30, 2020, an individual pleaded guilty to conspiring to steal medical trade secrets from her employer, the Research Institute at Nationwide Children’s Hospital in Ohio, to benefit a company she and her husband formed in China.
• On February 27, 2020, an individual was sentenced to prison for stealing trade secrets worth more than $1 billion from his employer, a U.S. petroleum company.
• On January 31, 2020, an individual was sentenced on weapons and drug charges after a successful Insider Threat investigation indicated he was planning acts of violence and stockpiling weapons while working at the U.S. Coast Guard, leading to his arrest.

Imagine you and your spouse were laid off recently. You have kids attending college or private school. You have a mortgage. Car payments. Utility bills and taxes. You need food, clothes, sneakers, phones, computers. Would you still be so quick to say no if someone asked you to gather some information for a sum of money? Or how about just to give access to a program temporarily? You’re not stealing. You won’t get anyone killed. It’s just data…

How You Can Use This Campaign

September 2020 marks the second annual recognition of this awareness month, and this year’s theme is “resilience.” Resilience, or the ability to bounce back from an emergency or setback, is a key component of any business plan. And whether you think you’re a target or not, putting preventive measures in place will always benefit your business. (Click here for backup and disaster recovery resources.)

According to NCSC Director William Evanina, “2020 has presented a unique risk environment. Covid-19 has impacted every single American. Many face serious adjustments – telework or other continuity of operations implementation, broken supply chains, and sometimes unreliable or overwhelmed technology capabilities. There are also the deeply personal human struggles related to health care, child care, financial insecurity, and political and cultural fissures. The risks for espionage, unauthorized disclosure, fraud, theft and even unwitting insider threat actions are higher than ever.”

Effective Insider Threat programs promote personal and organizational resilience to mitigate risks. These programs provide positive interventions when employees are struggling, offering them help before they potentially become insider threats.

It is important to note that Insider Threat programs across the U.S. government target anomalous activities, not individuals. Each agency’s Insider Threat program is coordinated with their respective legal counsel, civil liberties, and privacy officials to guarantee civil liberties, privacy, and whistleblower protections.

As our CEO says in the Top 3 Scams message sent on the first of every month, awareness is the key to prevention. Find and use these awareness materials from the NCSC in your business.

And find information specific to Insider Threat training from the NITTF here.

Or simply reach out to us with your questions.