Perhaps the most fundamental and important principle of leadership is taking care of people. Leaders embrace (some relish) responsibility for the welfare of their people. If INSA’s proposition in “Assessing the Mind of a Malicious Insider” is generally true—that is, that “that an initially loyal employee does not suddenly transform into a malicious insider”—then there must be some leadership responsibility in addressing the apparently growing problem of insider threats. Here are three ways leaders can make a big impact in addressing insider threat challenges.
KNOW YOUR PEOPLE
Leaders sequestered from their people simply do not know what’s really going on in their organizations, beyond briefings, which are often filled with what leaders want to hear, think they want to hear, or what staff and subordinate leaders believe they want and need to hear. Leaders can probably learn more about the effectiveness of their own leadership in a ten minute conversation with an employee, or two, or three. Visions and strategies brief well. But if the employees across the organization don’t know it or believe it, they’re not worth much when it comes to truly leading an organization in a particular direction.
Leaders who are sequestered from their people are not perceived as—and may not in actuality be—leaders who care much about their people. And according to INSA, caring about people is one of the most important aspects of heading off home-grown insider threats. “Caring enough to help employees through hard times,” INSA reports, “will likely eliminate many incidents and in the end prevent loss.” That doesn’t mean the senior leader has to sit down and have a cup of coffee with every employee. But subordinate leaders should. Ideally, every employee should know that there’s a genuine, compassionate chain of care that runs from first-line supervisors to the top floor.
Remember, “The lack of recognition or response by the organization in many cases encouraged the employees’ sense of entitlement and reduced their sense of accountability for their own actions. Effective management that deals with the minor lapses can create mitigating forces and perhaps rescue [an employee] who may eventually betray the organization.”
TAKE SIGNALS SERIOUSLY
According to INSA, employees on the road to becoming insider threats will often betray themselves, perhaps even before they know that they’re heading for trouble. What leaders may first interpret as a quirk in the performance of an otherwise apparently dependable employee—what INSA calls counterproductive work behavior (CWB)—could very well be warning signs of problems to come. Therefore, leaders must recognize these peculiar actions for what they may be: warning signs. Of course, truly caring for employees, knowing them, helps leaders be sensitive to these performance aberrations.
When identifying incidents of CWP, leaders have to consider that the first CWP may not be the last, that, unaddressed or ignored (or missed), it may get worse, and home-life matters. INSA explains, counterproductive work behavior against the organization (CWB-O) or against individuals (CWB-I) are warning signs. Reports INSA, “An individual who engages in one type of CWB will be more likely to engage in several . . . . Less severe incidents lead to more severe incidents . . . . [And] Stress at home or at work adds to the potential for counterproductive workplace behaviors . . . .”
GET THE RIGHT TOOLS
To be fair, all the kindness and compassion and genuine interest and best leadership in the world won’t put a quick end to the evolution of insider threats. Leaders should be well-familiar with and make deliberate decisions about employee all tools available to help recognize signs of employees heading to crisis. It’s a matter of helping protect employees, sensitive information, and, by extension, national security. INSA reports, “Three of the most relevant tools to assessing the risk that an individual may be moving toward a malicious insider act include personality mapping (psycholinguistics), life-event detection (text analytics), and emotion detection (sentiment analysis).”
Remember, however, that these sorts of tools by themselves won’t do it. And employing these sorts of tools without transparency with employees may simply introduce resentment and distrust in the organization, which would likely encourage rather than discourage insider threats. And the best tools are most effective when they are part of a larger plan. For instance, psycholinguistics should not be an isolated alarm system. Instead, it might be part of a larger insider threat program that includes the help of employee welfare resources. INSA suggests, “Employee assistance programs should be well known within the organization, effectively managed, and closely tied to the insider threat program.”
In the final analysis, most all of INSA’s recommendations are about good leadership. About leadership that’s engaged and that genuinely cares about the success of the organization and the people behind organizational success.
