Insider Threat Awareness Answers

Insider threats refer to the risks posed by individuals within an organization, such as employees, former employees, contractors, or business associates, who have inside information concerning the organization’s security practices, data, and computer systems.

Unlike external threats, which come from individuals outside the organization without authorized access, insider threats stem from those with approved access, either maliciously or inadvertently, misusing this access to harm the organization in some way.

These threats can manifest in various forms. From the deliberate stealing of confidential data for personal or financial gain, to the unintentional sharing of sensitive information due to negligence, the spectrum of insider threats is broad and varied.

Importance of Understanding Insider Threats:

1. Potential for Significant Damage: Since insiders have access to sensitive and confidential information, the potential damage they can cause can be severe. This damage isn’t just financial; it can also be reputational, operational, or strategic.
2. Increasing Prevalence: With the rise of digital tools and platforms, the ease with which data can be shared or stolen has increased. This makes understanding the nature of insider threats even more crucial.
3. Proactive Prevention: By understanding the nature and motivations behind insider threats, organizations can better develop measures to prevent them, rather than just reacting when they occur.
4. Building Trust: A proper understanding and handling of insider threats can ensure that while employees feel monitored for security, they don’t feel mistrusted. This balance is essential for maintaining a healthy organizational culture.

DoD Insider Threat Awareness Test Answers

Question	Answer
Phishing Scenario	This phishing attempt is from someone who’s not who they claim to be. Clicking the link in this email will take you to a website controlled by someone attempting to obtain your credentials, passwords, or other personal information. You should report this right away to your supervisor, security officer, or insider threat program.
Security Violation	Passwords should not be written and stored where they can be accessed by others. You should report this right away to your supervisor, security officer, or insider threat program.
Elicitation	You should report this right away to your supervisor, security officer, or insider threat program.
Financial Considerations	Report it
Conferences Scenario	You should report this right away to your supervisor, security officer, or insider threat program.
Technical Activity	You should report this right away to your supervisor, security officer, or insider threat program.
An insider is defined as any person with authorized access to any united states government resource to include personnel, facilities information, equipment, networks, or systems	True
Which of the following are insider threats : Fort Hood shootings Greg Chung – Economic Espionage Wiki Leaks	All of the above
Which of the following should be considered as reportable indicators of possible insider threats?	Unexplained or undue affluence Displaying questionable loyalty to U.S government Disgruntled employee
During the spot and assessment phase of the recruitment, the foreign intelligence service will often explore potential exploitable weakness which may be used as a lever against the recruit if needed later	true
Exploitable weaknesses by a foreign intelligence service when a considering a source for recruitment may include	Adultery Financial Problems Gambling Drugs or Alcohol
Unauthorized downloads or copying of files, especially for employees who have given notice of employment termination, is an indicator of a possible insider threat	True
Insider threat policy is only applicable to classified information. Sensitive, propriety, or need to know information is not currently protected by the insider threat program policy.	FALSE
Contact with a n individual who is known to be, or is suspended of being, associated with foreign intelligence, security, or terrorism, should always be considered a reportable indicator of a possible recruitment	True
Insiders work alone. They never recruit because it increases the chancer of them being caught.	False
Attempting to gain access to an unclassified automated information system without authorization may be considered an information collection indicator.	True
Which of the following could be considered a possible indicator of an insider threat?	All of the above
An insider threat is anyone with authorized access to the information or things an organization values most, and who uses that access, either wittingly or unwittingly, to inflict harm to the organization or national security. When an insider becomes a threat, it can have far-reaching consequences on both an organization and national security.	True
Why is the success of the Insider Threat Program important to everyone at DHS	All of the Above
One of your co-workers is exhibiting suspicious behavior. Which of the following should you report to the DHS Insider Threat Program?	All of the above
What are the most likely indicators of espionage?	Both A and C Divided loyalties Working outside of normal hours
You are a DHS project manager and you believe that one of your employees is exhibiting the following behaviors. Which behaviors should you report to the DHS Insider Threat Program?	Both a and b Downloading and saving a large amount of data that is not typical for their job Querying a database outside of their job duties
You overheard two colleagues having a discussion. Which of these discussions should be reported to the DHS Insider Threat Program?	Both b and c They expressed appreciation for the tactical abilities of an active shooter and appeared to idealize the perpetrator Both employees began screaming at each other
Your privacy, civil rights and civil liverties are protected under the DHS Insider Threat Program?	True
Everyone knows if you “see something, say something.” How should you report something to the DHS ITOC?	Both a and c Email the [email protected] Call 202-447-4200
Potential risk indicators (PRIs) are patterns of behavior that were documented from previous insider threat incidents. Any one of these PRIs may be insignificant on its own, but when it is observed in combination with other suspicious behaviors, it may warrant reporting.	True
Which of the following are potential indicators of unauthorized disclosure?	All of the above Attempting to work around security protocols Sense of “self above the rules” Repeated and unreasonable disregard for policy
Unintentional insider threats are not of concern at DHS since there is no malicious intent.	False

Authorized access to DoD information and resources may be granted based on a person’s _______________.	– Volunteer activities – Contractual relationship with DoD – Employment
The transfer of classified or proprietary information to a system not approved for the classification level or unaccredited or unauthorized systems, individuals, applications, or media is a _______________.	Spill
A member of your team openly discusses her financial difficulties and her inability to meet her financial obligations. What is the appropriate action?	Report the concerning behavior to your security officer
Which of the following is a reportable behavioral indicator?	Significant change in work habit
If you are contacted by a member of the media about information you are not authorized to share, you should take down which of the following details?	– Their name and their organization name – How they contacted you – Date and time of contact
Which of these may be targeted by foreign entities?	All of the above
_______________ is a conversation technique used to discreetly gather information that is not readily available and do so without raising suspicion.	Elicitation
Technological advances impact the insider threat by _______________.	– Allowing large amounts of data to be accessed – Presenting new security challenges
Which of the following is a technology-related indicator?	– Accessing systems at unusual hours without authorization – Keeping unauthorized backups
Which of the following countermeasures can help reduce technology-associated insider threats?	– Inventory your technology holdings – Watch for behavioral indicators
Insiders may include which of these groups of people?	– Employees – Former Employees – Contractors – Active duty Military
The definition of Targeted Violence includes which of these components?	– Any form of violence – Directed at an individual or group – For a specific reason
Which of the following are reportable behavioral indicators?	– Addictive behaviors – Substance abuse – Considerable change in financial circumstances
Contractors must report which of these?	All of the above
The acronym EAP stands for _______________?	Employee Assistance Program
To whom should you report if you are contacted by a member of the media about information you are not authorized to share?	Your security office
Contractors must report which of these to the insider threat program?	– Efforts to obtain unauthorized access to classified or proprietary information – Any contact by cleared employees with known or suspected intelligence officers from any country – Any contact that suggest the employee may be the target of attempted exploitation by the intelligence service of another country – Efforts to compromise a cleared employee
Who might be interested in non-public information that an insider can provide?	– Competitors – Non-state actors – Terrorist organizations – Foreign governments
Technological advances ______________________________.	– Increase risk of information loss – Allow insiders to access more data
Which of the following is a technology-related indicator?	– Hoarding files and data – Bypassing technology-associated protocols – Improper use of privileged access
Hostile entities may use social media to _______________?	All of the above
Which of these activities must be reported?	– Unauthorized disclosure of classified material – Inappropriate copying of classified material – Bypassing security rules or protocols

Indicators of Potential Insider Threats

Indicators of Potential Insider Threats

Recognizing the early signs of a potential insider threat is crucial for an organization’s security. By paying attention to various indicators, companies can implement preemptive measures to mitigate risks and protect sensitive data. These indicators can be broadly categorized into behavioral, technical, and those related to unusual access patterns.

---

Behavioral Indicators

These indicators revolve around the actions, reactions, and shifts in the demeanor or behavior of individuals within an organization.

• Changes in Work Habits: Drastic and unexplained changes in work routines or productivity.
• Expressions of Discontent: Consistent grievances or dissatisfaction with the organization, coworkers, or management.
• Unexplained Financial Transactions: A sudden display of wealth or signs of living beyond one’s means. Alternatively, openly discussing financial difficulties or pressures.
• Overstepping Boundaries: Seeking or trying to gain access to information that’s not relevant to their job role.
• Decreased Engagement: Withdrawal from colleagues, reluctance to participate in team activities, or isolating oneself.
• Reaction to Policies: Strong resistance to organizational policies, especially those concerning security or data access.

---

Technical Indicators

These indicators focus on the digital footprints and actions that might suggest misconduct or misuse of technological resources.

• Unauthorized Downloads: Downloading large volumes of data, especially on external storage devices.
• Misuse of Credentials: Using credentials to access areas of the network or systems beyond one’s required job functions.
• Bypassing Protocols: Attempting to bypass or disable security software or protocols.
• Irregular Device Connections: Connecting unauthorized devices or using unauthorized applications on company networks.
• Encryption Red Flags: Encrypting files without a clear business reason or using non-standard encryption methods.
• Cloud Storage Misuse: Uploading company data to personal or unauthorized cloud storage solutions.

---

Unusual Access Patterns

These are red flags related to when and how data or systems within the organization are accessed.

• Odd-hour Logins: Accessing systems during non-working hours without a clear reason or prior history of doing so.
• Frequent Failed Logins: Multiple failed login attempts, which might suggest either forgetfulness or malicious intent.
• Data Surge: Suddenly accessing, downloading, or transferring larger amounts of data than usual.
• Remote Access Spikes: Using remote access tools without prior approval or in scenarios where it’s not required.
• Accessing Irrelevant Data: Frequently accessing databases or files unrelated to one’s job responsibilities.
• Unusual Locations: Logging in from geographically unusual or different locations in quick successions.

Motivations behind Insider Threats

Understanding the motivations behind insider threats is critical for an organization to establish effective preventive and reactive measures. Often, these motivations are deeply personal and multifaceted. Here’s an in-depth exploration of some primary driving forces:

Financial Gain

• Overview: This is one of the most straightforward and common motivators for insider threats. Individuals motivated by financial gain are looking to benefit monetarily from their actions, whether through selling sensitive data, engaging in fraudulent activities, or other methods.
• Examples:
  • Selling company secrets to competitors or foreign entities.
  • Engaging in embezzlement or fraudulent transactions.
  • Mining cryptocurrencies using company resources.

Personal Grievances

• Overview: These threats stem from personal dissatisfaction or disputes within the workplace. An individual might feel overlooked, mistreated, or believe they’ve been wronged in some way.
• Examples:
  • Disgruntled employees sabotaging company operations or systems.
  • Leaking confidential data to harm the organization’s reputation.
  • Collaborating with external entities to get back at the organization.

Ideological Beliefs

• Overview: Ideologically-driven insiders are motivated by deeply-held personal beliefs. These beliefs might be political, religious, or ethical in nature. The person isn’t usually looking for personal gain but believes that their actions serve a higher purpose or cause.
• Examples:
  • Leaking sensitive data in the belief that the public has a right to know.
  • Sabotaging specific company projects or collaborations that go against personal beliefs.
  • Supporting external groups or causes that conflict with the organization’s objectives.

External Influences or Coercion

• Overview: Sometimes, the threat doesn’t originate from the insider’s initiative but due to pressure from external sources. These can be personal or professional connections, or even criminal groups, that have leverage over the insider.
• Examples:
  • Being blackmailed into providing access to sensitive areas of an organization.
  • Providing confidential data due to threats against the insider’s family or loved ones.
  • Being manipulated or convinced by external entities, like foreign governments or rival organizations, to act against the company.