How financial triggers can help spot insider threats

Many high-profile and very public incidents have demonstrated that public-sector agencies are vulnerable to espionage, sabotage, intellectual property theft, workplace violence and fraud. The unfortunate reality is that these activities often come from the inside.

Because some federal employees and contractors pose a persistent yet unseen security risk, predicting insider threats before an incident occurs is key to limiting the damage. While a clear majority of insider threats stem from unintentional negligence, malicious insider threats are the costliest. Data shows that malicious internal threats cost 40% more than employee negligence.

However, uncovering these threats can be difficult, which makes an early warning system for government agencies and departments crucial.  Factors that may correlate with an insider threat include inappropriate personal behaviors resulting from mental health issues or substance abuse, personal and financial stressors (one of the key risk factors that can lead to malicious insider threats) along with other concerning behaviors, such as negative or consistently erratic postings on social media accounts.

While the public and private sectors both monitor for insider threats, some agencies lag behind in implementing a financial triggers program that track employees’ spending habits and the financial stressors that could lead to problems. Financial triggers programs have been used by lending institutions for decades to continuously monitor consumers for credit risk determination. For example, banks may ask a credit bureau to inform them when a consumer’s overall debt reaches certain upper or lower thresholds, which helps inform their marketing decisions.

Government may benefit from repurposing private-sector financial triggers programs to monitor employees for security risks. While most federal agencies have implemented continuous vetting programs to support insider threat detection, those programs fail to leverage the power of a financial triggers program. Enrolling agency populations in a financial triggers program would strengthen existing security monitoring while substantially reducing the work of sifting through credit-related changes to find those that may be indicators of security concerns.

Continuous evaluation and vetting to monitor ongoing risk is a widely accepted truism, but security programs should mature as new capabilities are created. While an agency may know an employee’s job status has changed, for example, other outside risk factors may be less apparent and require additional attention.  These factors could include taking on too much debt in a short amount time, being late on mortgage or other loan repayments or obtaining additional mortgages with no apparent increase in income. A continuous evaluation program leveraging Fair Credit Reporting Act-compliant data can provide real-time triggers across these key risk factors.

Trended credit reports

Government security managers must understand if a cleared employee is behaving in a way that might make him or her vulnerable to coercion or blackmail due to financial distress. Currently, they can analyze periodic credit reports and other data to determine if an employee’s financial situation is deteriorating or if there are new sources of undeclared or unexplained income.

A robust financial triggers program with trended analysis covers an employee’s credit-related behavior over time, which provides a more fulsome understanding of potential risk compared to the traditional snapshot-in-time credit score that is often used to determine credit worthiness. By analyzing credit records from a 30-month period, for example, lending institutions may better determine whether a customer is heading toward financial distress or has been regularly paying down debt, trending towards a lower risk.

Government security program managers can benefit from a similar process for continuous security risk evaluation. An agency can give a credit bureau information on the population it wants monitored along with certain parameters, and the credit bureau then returns only relevant information. This saves the security manager from having to pull all data on personnel,  significantly reducing the amount that requires analysis.

Proactive v. reactive

Few security risk indicators are predictive in nature, but financial triggers on credit records are an exception. For example, evaluating public records will not help security personnel predict if an employee will get a citation for drunk driving. There may be signs of a drinking problem, but it is virtually impossible to determine whether that person will get a DUI within the next three months.  

Continuous evaluation via a triggers program on an employees’ credit and financial status, however, makes predicting their trajectory toward financial distress highly accurate based on proven algorithms.

Some security managers may be reluctant to enroll their personnel into a financial triggers program due to the perceived risk of their employees’ personally identifiable information being exposed. This is especially true in the intelligence community, but this concern can be addressed by a variety of techniques that provide safeguards and some level of anonymity once employees are enrolled.

A key first step: Study the population

One way security managers can understand how their population looks from a risk perspective is to conduct a series of low/no cost focused studies. These anonymized studies can present a more holistic picture of employees’ financial and public records postures and indicate the percentage that have little to no perceivable security risk-related issues, the percentage that have some perceivable risk, and the small fraction that may be considered high risk. 

These studies will also give agencies an awareness of their employees’ financial health and help them gauge the effectiveness of the financial component of an insider threat program. Periodic studies will indicate improvements over time, which will help program managers make future resource allocation decisions.

By gaining a better understanding of employee financial well-being over time, government agencies stand to benefit.  They can save money and protect their reputations, identify those at risk before they become real insider threats and build a trusted workforce through improved risk assessments.