8.7.2. Personnel Safety and Insider Threat

💡 First Principle: Personnel security addresses two distinct threats: protecting people from harm (safety) and protecting the organization from people (insider threat). Both require operational controls — the first through emergency procedures, travel security, and workplace safety programs; the second through behavioral monitoring, separation of duties, mandatory vacations, and job rotation.

Insider threat indicators:

Insider threats are among the most difficult to detect because the malicious actor has legitimate access. Behavioral indicators that may signal insider risk:

Indicators create suspicion, not proof. Bring in HR and Legal, increase monitoring and review the person's access, and agree a coordinated response before any confrontation. Unless there is confirmed exfiltration that must be stopped at once, abrupt termination or unannounced revocation can tip off the subject, push exfiltration to other channels, and create employment-law exposure if the activity proves innocent.

Operational controls for insider threat:

• Separation of duties — No single individual can complete a critical process (e.g., creating and approving a financial transaction). Forces collusion for fraud.

• Dual control (two-person integrity) — Two individuals must act together for sensitive operations (e.g., two key holders required to access the vault, two administrators required to modify critical system configurations).

• Mandatory vacation — Requiring employees in sensitive positions to take consecutive vacation days. Fraud schemes often require the perpetrator's daily presence to maintain; mandatory absence exposes the scheme to a substitute who notices anomalies.

• Job rotation — Periodically rotating employees through different roles prevents excessive accumulation of knowledge and access that could be exploited, and ensures cross-training.

• Responding to indicators — when an employee under notice starts bulk-downloading sensitive data, restrict access immediately while preserving evidence, and coordinate HR, legal and security. Do not confront the employee alone or let the exfiltration continue to "build a case".

• Insider threat is cross-domain — misuse of legitimate access is rarely stopped by one control: pre-employment screening (D1), classification-driven DLP on sensitive data (D2), least privilege and periodic access reviews (D5), UEBA baselining of unusual queries and bulk exports (D6/D7 monitoring), and a forensically sound investigation with law-enforcement liaison when warranted (D7).

Personnel safety operations:

• Duress systems — Silent alarm mechanisms that allow personnel to signal that they are being coerced (duress PIN on access control, panic buttons at reception desks). The system must respond without alerting the coercer.
• Emergency management — Evacuation procedures, shelter-in-place protocols, assembly points, accountability systems. Regular drills required. Integration with local emergency services.
• Travel security — Procedures for personnel traveling to high-risk locations: encrypted devices, minimal data, pre-travel briefing, check-in protocols, emergency contact procedures. Devices used during travel to high-risk countries should be wiped or replaced upon return.

⚠️ Exam Trap: Mandatory vacation and job rotation are detective controls, not preventive ones — they do not prevent an insider from committing fraud, but they increase the probability of detection by creating opportunities for others to review the insider's work. The exam tests whether you correctly classify these as detective (not preventive) controls.

Reflection Question: A database administrator has worked alone managing the organization's financial databases for 7 years. They have never taken more than 2 consecutive days off, have resisted all attempts to cross-train a backup, and recently expressed frustration about being passed over for a promotion. Identify the insider threat risk factors present, describe three operational controls that should be implemented, and explain the governance challenge of implementing mandatory vacation when the employee is the only person with the required expertise.