Personnel Security & Insider Threats Flashcards

What is the primary goal of a personnel security program in a physical security context?

Answer: To identify and mitigate risks posed by individuals with authorized access

Personnel security programs focus on identifying and mitigating risks from individuals who have legitimate access to facilities or sensitive assets.

Which of the following is a key indicator of potential insider threat activity?

Answer: Accessing systems and areas outside normal job duties

Accessing systems or areas beyond an employee's role is a classic behavioral indicator of insider threat activity.

A pre-employment background investigation for a sensitive position should include which of the following?

Answer: Criminal history, employment verification, and reference checks

Comprehensive background investigations for sensitive roles typically include criminal history, employment verification, and professional reference checks.

What does the term 'need-to-know' mean in personnel security?

Answer: Access to sensitive information is limited to those who require it to perform their duties

The need-to-know principle restricts access to sensitive information only to personnel who require it to fulfill their specific job responsibilities.

Which personnel security measure helps detect unauthorized disclosure of proprietary information?

Answer: Non-disclosure agreements (NDAs) combined with access logging

NDAs establish legal obligations while access logging provides an audit trail to detect and investigate unauthorized disclosures.

What is 'two-person integrity' (TPI) as applied to personnel security?

Answer: A policy requiring two authorized individuals to be present for access to sensitive areas or materials

Two-person integrity requires that at least two authorized individuals are present when accessing sensitive areas or materials, reducing the risk of insider misconduct.