Insider risk: Don't ignore the community context

Just a few months ago, many security professionals confessed concern about a potential economic downturn and how that would impact the security environment around them. Some were troubled about possible layoffs at their company, and others mentioned rising crime rates. All of them discussed how either could affect insider risk within their organization.

Yet, as this is being written, things are a bit sunnier — inflation and crime are down significantly.

Understanding the local context is crucial for managing insider risk. So, whether overseeing a single facility or a sprawling network, here are some broad indicators to help security leaders assess the situation in each area.

Consider the macro

It is essential to look for signs of stress that go beyond the statistics, things that often rise in times of economic stress: drug and alcohol abuse, increases in divorce rates, stealing, broken windows and unmaintained homes, for example. Employees may be okay, but they may have relatives or people dependent on them who are struggling. Financial distress can result from these issues — and that can be a key motivator behind insider threats. By taking a broader view of a community and anticipating potential consequences, security leaders unlock the power of data to manage and minimize insider threats proactively.

Community engagement and feedback

Are conversations being held with members of the local community? Is the organization using online forums or surveys to get local opinions or attending town halls to see what motivates people? Direct feedback can provide valuable insights and highlight discrepancies between national trends and local experiences. The dissonance between national data and local anxieties about issues such as crime suggests potential psychosocial stressors within the community, which, if unaddressed, can heighten the risk of individuals acting unexpectedly and irrationally, thus becoming a risk.

Collaboration with local agencies

Most security teams probably have a working relationship with law enforcement. But what about local health departments or social service groups? Staying in touch with these organizations and monitoring their postings on social media can offer a holistic view of community’s health and safety. These groups can provide information about crime, health emergencies, social issues and trends not shown in general economic reports.

Community issues ripple deeper than headlines. Job losses in seemingly unrelated sectors might not make the news, but they can trigger economic hardship, emotional strain and despair within employee circles. Partner with local organizations to understand these hidden anxieties and proactively address them before they escalate into insider threats by asking them what they observe relative to the news cycle.

Monitoring social media and local news

It’s 2024. Social media platforms and local news outlets are valuable sources for gauging public sentiment and staying informed about local events and issues. They often provide real-time updates and grassroots perspectives that official reports may not capture. Scanning these sources can help security professionals stay attuned to emerging trends or concerns within the community. For instance, increasing online discussions about financial hardships and economic stress in a particular area could be a bellwether to looming insider threats.

Implementing technology for data analysis

Today’s digital environment offers several avenues for threat intelligence gathering. Security leaders may be able to map social media posts to emergency calls — police, fire and EMS — within an area near the facility. These tools can identify patterns or anomalies in local data that illuminate local trends. They can also help to visualize note-worthy events, from protests to weather disruptions, within the local community or across different sites. Data analytics tools can aid in processing and interpreting large volumes of information from various sources, including OSINT and the dark web.

While gauging a community’s pulse through online chatter and local news can’t predict individual behavior, it can illuminate potential hotspots. Financial hardship, economic stress and even local events can exacerbate personal pressures, increasing the risk of insider threats driven by financial anxiety, job insecurity or emotional turmoil.

Remember, according to CISA’s Insider Threat Mitigation guide, the path to serious insider incidents like workplace violence or data theft isn’t solely about immediate stressors. It’s also marked by a combination of factors: pre-existing vulnerabilities in individuals, concerning behaviors and inadequate organizational response mechanisms.

Modern security teams are drowning in data and telemetry and devoting resources toward its analysis. Gathering information on the state of local community and the macroeconomic environment in the country can help security leaders ascribe color and context to raw data. It can also help them anticipate issues and allocate resources more effectively.

The line between internal and external threats blurs in the modern world, demanding a security posture beyond the firewall. True security professionals understand that vigilance alone isn’t enough. Security leaders must become students of the communities they serve, deciphering the whispers of discontent and the rising tides of stress. It isn’t simply about protecting the organization but nurturing the ecosystem that sustains us. By proactively engaging with community indicators, security leaders become prescient partners, weaving ourselves into the tapestry of resilience. In doing so, security leaders don’t just mitigate risks; they amplify security’s impact, creating a ripple effect of stability and strength that extends far beyond their own walls.