The Cybersecurity and Infrastructure Security Agency (CISA) has released an updated version of a guide designed to help organizations identify, address and mitigate insider threats.

The updated guide incorporates new case studies and statistics and consolidates sections to make the material easier to navigate. It expands on emerging workplace trends, including the continued growth of hybrid and remote work arrangements and the use of artificial intelligence to manipulate or deceive individuals within an organization. The guide also adds new content on access control, visitor screening and managing the risks associated with adverse employee separations. In addition, it directs organizations to newly released CISA resources intended to support early risk detection and overall preparedness.

Scott Breor, acting executive assistant director for infrastructure security at CISA, said insider threats continue to change as technology advances and encouraged organizations to put mitigation programs in place.

We urge organizations to establish a mitigation program that protects key assets, prevent violence, reduce losses, safeguard sensitive data, and save lives.

Breor also stated: “CISA appreciates the industry and government partner feedback that informed this timely update. CISA encourages organizations to review this updated guide, assess their program, and recommended steps to bolster their threat mitigation program.”

What Are the Characteristics of an Effective Insider Threat Mitigation Program?

According to the CISA guide, the characteristics of an effective insider threat mitigation program are:

1. Pinpoints critical assets and data the organization considers most valuable and worth protecting
2. Evaluates risk levels tied to individual insiders based on the threat they may pose
3. Addresses insider threats broadly, incorporating approaches aimed at the individual, potential victims and vulnerable areas of the organization
4. Works directly with at-risk individuals who may be moving toward harmful behavior, aiming to deter and intervene before an incident occurs
5. Controls and tracks access across the organization to limit harm from both deliberate and accidental actions

How Is CISA Strengthening Cybersecurity Beyond the Updated Guide?

CISA has continued to advance a range of related cybersecurity initiatives. The agency joined the FBI and international partners to issue guidance for outage communications, and it introduced a logging reference architecture intended to strengthen visibility across federal networks.

On the insider threat front, the agency previously released an infographic on assembling a multidisciplinary insider threat management team, building on the same mission the updated guide now supports.

On the procurement side, the agency issued a request for information on cyber tools worth up to $6 billion. It’s also sharpening its focus on open source software security.

Meanwhile, two contracts are advancing its technical capabilities, including a threat hunting and cyber operations support opportunity and a follow-on cybersecurity operations contract.

Key Questions This Article Answers

• What are the five characteristics of an effective insider threat mitigation program?

• How can organizations identify, assess, and reduce insider threats before an incident occurs?

The original article can be found here.

CISA’s official press release can be found here.