We deliver training to the analysts and executive team who will be directly monitoring for insider threats, sometimes referred to as the "HUB". We teach the principles of appropriate insider threat detection, who should be involved, escalation procedures, policies, collaboration and effective communication.
Insider Threat Training - Working Group
The job of the insider threat working group (also called the HUB) is to separate the signal from the noise, and then act appropriately. Once an organization has established a strong culture of insider security, there should be more frequent reports of individuals exhibiting one or more of the risk indicators. An important role for the HUB is to distinguish between what's a real threat, and what is simply "unusual" but innocuous behavior. Typically, the HUB is a group of individuals from across the organization (mostly at significant leadership levels such as VP, or Director) including legal, finance, human resources, and security. The job of the HUB is to ingest, authenticate and analyze insider threat tips from employees, contractors and even outsiders to determine whether or not a real threat to the organization exists. Often, the HUB will need to collaborate and gather information from across several departments in order to create a more complete picture of a potential threat. Human resources may have clues from a previous performance appraisal, finance may have had a report of theft of petty cash, a current supervisor may have awareness of recent tardiness. These clues individually may not set off an alarm, but putting them together quite possibly could. That's the point of the HUB.
A typical syllabus for the Working Group training follows this path.
- Culture of Security
- Insider Threat Examples
- Insider Threat Indicators
- Working Group Roles and Responsibilities
- Cross-departmental Communications and Cooperation
- Tip Line
- Deep Insider Threat Research - How-to guide
- Insider Threat Response
- Meeting Cadence
- Getting Started
This is a one-day (7-8 hour) course typically provided on-site at the client's facility with a maximum individual class size of 20. Soteritech may arrange classroom space and refreshments if needed at an additional charge.