Human behaviour and insider threat: Part Three

In order to identify the psycho-physiological indicators of insider threat, a company may wish to engage technologies and procedures specifically designed for this purpose.

Software can be adopted that uses existing or recorded videos to analyse and indentify human micro-vibrations associated with elevated levels of stress, anxiety/tension, aggression, fear. Changes in micro-vibration parameters registered between two consecutive frames are analysed over a period of time (0.5 – 2 seconds ore more) to single out individuals who exhibit psychophysiological indicators of a higher than normal emotional status.

Software such as this is already employed at various international airports, public areas, sports events and high risk facilities. The VImage PRO software from Alton Corporation offers a consistently high detection accuracy (4 – 9% false positives, depending on set up and configuration, and 10^-6 false negatives).

Access and movement monitoring

In order to address one of the greatest concerns in regards to insider threat, a privileged user gone rogue, an enterprise can opt to enhance its CCTV operation with a software such as the VImage PRO described above.

After a baseline threshold for a higher risk location at an organisation is established, any employee appearing on a CCTV monitor with elevated levels of stress would be automatically detected, requiring a Security Operations Centre operator to initiate follow-up procedure. Different rooms in the building can have their own threshold levels corresponding to expected psycho-physiological levels.

Periodic performance evaluations

Berk accentuates that monitoring for insider threat must become part of a company’s continuous deterrence and mitigation strategy. If introduced as part of a periodic performance evaluation process, and conducted in line with existing legal and privacy policies, a short interview focusing on unauthorized sharing of sensitive information or suspected fraudulent activities would provide a clear indication of someone’s involvement in these activities without the need for a full investigation. Such non-intrusive interviews could be conducted in less than 10 mins on a planned or random basis to increase the deterrence value. 

Adapted from a report by Emma McAleavey.

Read the article online at: https://www.hydrocarbonengineering.com/gas-processing/08082014/identifying-insider-threat-1083/