Insider threats within an Organization can manifest themselves in many ways. There are many experts who will provide organizations with a laundry list of indicators to assess an employee's propensity to commit espionage. Unfortunately, people are complex and rarely follow a prescribed checklist of indicators that an Organization can then use to predict their intent.
What people say they will do and what they actually do are often not the same thing; so effective leaders within an Organization have to shape and establish a baseline of normal employee behaviors. This can be accomplished by understanding what motivates their employees, what are their career goals, and who or what inspires them. Establishing this baseline can help leaders shape and inspire their employees to work towards a common business objective and root out the behaviors that lead to espionage.
Inspiring people to not want to become an insider threat starts at the top with Senior Leadership and how well they build teams. Leaders have to do several things:
Define a vision – A team with no direction or common goals is not grounded and cannot be inspired to achieve anything.
Develop a Mission Statement – Give your team the gift of a 30 second elevator speech that encapsulates their purpose and clearly defines what they work hard to achieve each and every day.
Validate the other person’s point of view – While you may not share that same point of view, you demonstrate your understanding by listening.
Understand what is important to them...Family, Salary, work…etc.
Build Trust – Effective leaders allow themselves to be humbled in front of their team. Being vulnerable in this way is actually a strength, because it shows your team that you are like them and you are in it with them. When you allow your shields to be lowered they will feel comfortable doing the same. When this happens, this is where true trust and professional relationship building begins.
Earlier this year I attended an Insider Threat Brief where one of the guest speakers was Mr. Robin Dreeke. Mr. Dreeke, an engaging speaker with an impressive background in Emotional Intelligence (EQ-I 2.0) and a certified practitioner of Myers Briggs Type Indicators® (MBTI®) had some very interesting perspectives to share on Insider Threat behavioral analysis and strategies on how an organization can implement and manage an effective insider threat program. One strategy that resonated with me was his discussion on the difference between convincing a person not to do something versus inspiring a person not to do something.
Convincing a person to see things your way and to get on board with your objectives is rarely successful because you are effectively asking that person to set aside their beliefs and goals and replace them with your own. The other option of inspiring a person to get on board with your goals involves getting that person to see how both sides can mutually benefit and how their contribution adds to the overall success. When you do this you create an environment where people are fulfilled in their work and want to help everyone succeed… there by reducing the risk of insider threat. Mr. Dreeke also shared some tips on how to manage the unfortunate times when an Organization may have to deal directly with a suspected Insider Threat incident. He described it as "crafting the encounter":
Use specific validation of a strength that person has demonstrated
Seek thoughts and opinions
Don’t let ourselves become emotionally high jacked by our ego or objectives. Remember this is a “Discovery” process.
Treat people with Empathy...Don’t judge
When we judge...defenses go up and prevent us from getting to the motivating factors that got that person off track.
Empower the person with choice over the outcome.
In the end, rooting out Insider Threat risk within Organizations is as much about building good teams as it is about inspiring people to do the right thing. Remember, establishing a baseline of what is normal behavior inside your organization will make deviations to those norms easier to identify and less impactful.