Personnel Security & Insider Threats Flashcards

What is the recommended first step when an insider threat is confirmed?

Answer: Notify legal counsel and initiate a coordinated response involving security, HR, and legal

A coordinated response involving security, HR, and legal counsel ensures the situation is handled lawfully and evidence is preserved.

A 'separation of duties' policy in personnel security is designed to:

Answer: Prevent any single employee from having complete control over a critical process or sensitive asset

Separation of duties divides critical tasks among multiple employees, reducing the risk that any one person can commit fraud or cause harm undetected.

Which of the following best describes 'security awareness training' in personnel security?

Answer: Educating employees on security policies, threat indicators, and reporting procedures to create a security-conscious workforce

Security awareness training builds a human firewall by ensuring all employees understand threats, policies, and how to report suspicious behavior.

Under a robust offboarding process, which action is the MOST critical from a physical security perspective?

Answer: Revoking all access credentials, collecting physical badges, and conducting an exit interview

Revoking credentials, recovering access media, and conducting an exit interview ensures a clean break and reduces residual access risk.

What is a 'hotline' or 'tip line' used for in an insider threat program?

Answer: To provide employees a confidential channel to report suspicious behavior without fear of retaliation

Anonymous tip lines encourage employees to report concerns about colleagues without fear of retaliation, supporting early detection of insider threats.

Which of the following is a characteristic of a 'trusted insider' threat?

Answer: An employee or contractor with legitimate authorized access who misuses that access

A trusted insider is someone with legitimately granted access — such as an employee or contractor — who misuses that access for unauthorized purposes.