In many countries there is a screening in place as a preventive mitigation tool against the insider threat. This provides a picture of a person at a specific moment in time. Even though these screenings are conducted on a regular basis, it is necessary to have some sort of follow up of these people who work with sensitive material or sensitive information. In Belgium, we have a security officer who will be responsible for demands of screenings and to follow up the people who are screened. It is however difficult to have one person who is responsible for everyone in a facility. There should be a system in place where signs of changing of behaviour can be signalled in order to react. In this setting it is important to define a baseline of behaviour. In order to define a change in behaviour. The difficulty is that every person is different and it is impossible to have a basic baseline and in cannot really be done by someone who is not in regular contact with the person. It is therefore very important to identify functions that are in the possibility to identify change. During the international Symposium on Insider Threat Mitigation in March 2019 we have done an exercise on this topic. We set out a profile and indicated a ‘baseline behaviour’. Based on indicated signs of changes in behaviour we challenged the group to think about when and how they would react. The reaction and the way it was conducted depends on the legislative options and of the culture of the country, the company and the security culture. In aftercare, it is a challenge to have concrete guidance, mainly because it depends so much on the legal possibilities and the culture. It is clear that there needs to be some sort of system in order to follow up people who have been screened and that it needs to take into account different partners in the facility. In the paper we would like to address these challenges and look and the different roles and responsibilities to report in an aftercare system.
Year
2020
Abstract