Insider Threat Awareness

Which of the following scenarios describes individuals who may pose a potential insider threat, based on the National Insider Threat Task Force (NITTF) definition? Select all that apply.

Maria is a project manager for a cleared defense contractor. She has been granted Secret eligibility.

Jorge’s facility received a warning that facilities with their capabilities are at higher risk of adversarial targeting. What types of information at Jorge’s facility do adversaries target? Select all that apply.

– Personnel lists and facility locations
– Countries the facility works with
– Information related to the facility’s methodologies, capabilities, and limitations

Which of the following scenarios may be indicative of adversarial targeting? Select all that apply.

– A scientist at your facility receives an unsolicited request to review a research paper.
– Your company’s sales department receives a purchase request from an unknown vendor.
– During a conference overseas, a researcher’s laptop is stolen.

Consider the following scenarios. Which may indicate an insider threat vulnerability? Select all that apply.

Shawn works in facilities management for a cleared defense contractor. His coworkers complain that he doesn’t think the rules apply to him. He has been written up several times for violating security procedures and protocols.

Jack works for a cleared defense contractor. He recently purchased a large, expensive home well outside the price range of his salary. It is a significant upgrade from his previous home, and it is unclear how he was able to make such a large purchase. What should his coworkers do?

Report it. Financial concerns are a potential risk indicator.

Consider the following scenarios. Which are behavioral indicators that must be reported? Select all that apply.

– Bill disregards security procedures and protocols regularly. He often piggybacks into the building and leaves sensitive materials out in the open.
– Fatima asked her coworkers about overtime. She told them she is in excessive debt and is looking to quickly make extra money.

Consider the following scenarios. Which behaviors must be reported? Select all that apply.

– Nissrine copies all the information she can get her hands on, including classified information. She files it away in a locked storage unit.
– Frank suddenly started drinking a lot. He often shows up to work intoxicated and falls asleep at this desk.

Carmen has been drinking a lot. She knows it’s becoming a problem but she’s having a hard time stopping on her own. What can Carmen do to help reach a positive outcome?

Contact the Employee Assistance Program (EAP.)

Several employees noticed Paul exhibiting potential risk indicators. Who is responsible for reporting the potential threat? Select all that apply.

– Coworkers
– Human Resources
– Leadership personnel
– Security personnel

Sarah is a scientist at a cleared defense contractor. She received a letter asking her to submit a paper related to research on satellite technology that has both military and civilian uses. Sarah reported the request. Why would she have done so? Select all that apply.

– She needs to verify that she can submit all requested information.
– This type of request could be an adversary’s attempt to collect information.

Which of the following scenarios are considered a potential insider threat vulnerability? Select all that apply.

– John’s disgruntlement with his employer is well known to his coworkers. He regularly displays negligence by ignoring his job responsibilities and not completing his work duties.
– Diane works extra hours to cover her gambling addiction.

Tim is experiencing a lot of stress. His engagement was called off, and he was denied a promotion at work. He recently purchased an expensive car. What potential insider threat risk indicators does Tim exhibit? Select all that apply.

– Personal issues: His engagement was called off.
– Financial issues: He purchased sports car.
– Professional issues: He didn’t get the promotion he wanted.

Samara is a DOD employee. A coworker recently discovered that she stays much later than usual, often working hours later than the rest of her team though her team is not authorized to work additional hours or overtime. What should her coworker do?

Report it. It is everyone’s responsibility to report concerning behavior.

Consider the following scenarios. Which behaviors must be reported? Select all that apply.

– A co-worker is seen taking a box marked CONFIDENTIAL to his car.
– A co-worker is suddenly acting erratically and keeps saying people are following him.

A coworker shares that she and her husband are facing foreclosure, and she doesn't know what to do. How can you help your coworker reach a better outcome?

Suggest that she contact the Employee Assistance Program (EAP).

Your agency was the target of sabotage. Who is responsible for reporting the potential threat? Select all that apply.

– Leadership personnel
– Human Resources
– Employees
– Security personnel

Rose is a federal agency employee. She was targeted by a foreign collection attempt. To whom should Rose report a potential threat?

Insider Threat Program, security office, or supervisor

Robb is a DOD employee. He knows he must report potential threats. Which of the following must he report? Select all that apply.

– Efforts to compromise individuals with national security eligibility
– Foreign contacts
– Unauthorized disclosure of classified information

Theo is a DOD employee. He shared with his co-worker that he recently ended his engagement. He purchased an expensive car and is moving across the country. To whom should his coworker report this behavior?

Insider Threat Program

Which of the following scenarios describe a potential insider threat? Select all that apply.

– A project manager at a cleared facility accidentally takes home a document marked Controlled Unclassified Information (CUI).
– An employee takes a photo at their desk and posts it to social media. Documents marked CONFIDENTIAL are visible in the photo.

Which of the following is true about insider threats?

Insider threats can include employees, vendors, contractors, volunteers, and anyone with authorized access to U.S. Government resources.

Sun works for a private cleared defense contractor. Her facility recently experienced suspicious network activity, but they have not yet located the source. Could the facility be the victim of adversarial targeting? Why or why not?

Yes, adversaries target both public and private organizations.

Victoria believes her facility is being targeted by a potential adversary. What could she have experienced or observed to believe this?

Her facility’s cybersecurity tools indicate suspicious network activity.

Mateo purchased a home with the intention of flipping it. The housing market shifted before he was able to sell putting him in significant debt. Based on this information, is Mateo at increased vulnerability of insider threat? Why or why not?

Yes, significant debt is a known stressor that may increase insider threat vulnerability.

Marion is a DOD program manager. She has worked in her department longer than anyone else on her team. She believes her seniority exempts her from security procedures and protocols and routinely violates them. Should her team report her? Why or why not?

Yes, disregard for security procedures and protocols is a reportable behavioral indicator.

Justin is upset that he wasn’t assigned the new radar project. He is very interested in the technology. He constantly asks his teammate Claire to share classified, project-related information with him, though he is not on the project and doesn’t have a need-to-know. What should Claire do?

Report it. Seeking classified information without a need-to-know is a reportable behavioral indicator.

Farrah hears a co-worker, upset with his boss, say, “If I had a gun, I would shoot her!” What should Farrah do and why?

Report it. Threatening violence is a reportable behavioral concern.

Tony is stressed out about his contract ending and is worried about finding a new job. He is missing meetings and snapping at co-workers. What should Tony’s boss do to create a better outcome for Tony and the organization?

Refer him to the Employee Assistance Program (EAP).

Patricia’s facility conducted Insider Threat training for everyone in the facility. They stressed that everyone in an organization is responsible for security. Is everyone responsible for reporting concerning behavior and potential threats? Why or why not?

Yes, because Insider Threat programs rely on everyone to report concerning behavior to get a fuller picture of potential threats.

Following a conference, Jacqueline, a DOD contractor, received repeated emails from another attendee requesting specific information about the technology that Jacqueline presented on. Jacqueline blocked the other attendee’s communications. Should she report this? Why or why not?

Yes, she should report this to her Facility Security Officer (FSO) as a potential collection attempt.

Consider the following. What must contractors report? Select all that apply.

– Events that impact the status of an individual’s personnel security clearance
– Events that impact the status of the facility

Paul works for a cleared defense contractor and has been granted Top Secret eligibility. His coworkers observed him speaking on his personal cell phone in the Sensitive Compartmented Information Facility (SCIF). To whom should his coworkers report this behavior?

Insider Threat Program Senior Official (ITPSO) or Facility Security Officer (FSO)

Insider Threat Awareness

help us help you

Air Force Hub

We are listening, send us your thoughts