Confronting the Insider Threat

By Laura Spadanuta

Psycholinguistic changes. Psycholinguistic changes can be a tipoff that someone is becoming an insider threat. These can be discovered in some cases through personal interaction as well as e-mail monitoring with special programs. “They’ll start not only complaining more but you’ll see sentences that have the word ‘I’ in it more. ‘I did this, and I’m not appreciated. I did this, and you did this to me when I did that.’ So it’s becoming more focused on them as opposed to business,” says Stock.

Stock says another psycholinguistic trait to look for is what is known as aversive frustration: “‘I have a goal. My goal is to get a promotion. You, my supervisor, are standing in my way. So, now as I’m trying to move towards my goal, you’re keeping me from that. The more I feel that I’m being kept away from my goal, averted from that, the more frustrated I become. The more frustrated I become, the more I think of what I need to do to get to where I need to be.’ So that sense of frustration comes out so the person will say things like, ‘you know, I’ve been here for 15 years, and this is how you treat me. I’m not appreciated. You say that you want me to succeed but you’re standing in my way.’ So you see that shift.”

Cognitive distortion is another possible indicator that someone may be going down the path of becoming a threat; it’s when the person misinterprets others’ actions. And McGarvey says that individuals will sometimes “demonize” the company or their coworkers. That’s “where you start talking about an individual or other individuals and really saying things about them to dehumanize them in your mind. You see that in countries, you see it with groups…. You start talking about how bad the company is, how they’re doing this, how they’re doing that,” McGarvey says.

Risk assessment.

No one person in the company is going to have the complete picture of any one individual, so companies may want to have a team composed of representatives from various departments that meets periodically to discuss whether anyone sees signs of any insiders exhibiting behavior that seems troubling. The team should include representatives from human resources, security, legal, and others as appropriate, so that all of them can bring together their perspectives on the risk.



The Magazine — Past Issues


Beyond Print

SM Online

See all the latest links and resources that supplement the current issue of Security Management magazine.