3
3
3
3
Vigilance by staff and managers is recognised as a key facet of effective nuclear security culture, along with compliance with rules, regulations and procedures, and a proactive questioning attitude on the part of personnel. Specific guidance on indicators however are not provided by the IAEA, and instead may be best drawn from other organisations.
The National Cybersecurity and Communications Integration Center, within the US Department of Homeland Security, has compiled a list of ‘general behavioural characteristics’ regarding insiders at risk of becoming a threat’. These include:
1. Introversion
2. Greed / financial need
3. Vulnerability to blackmail
4. Compulsive and destructive behaviour
5. Rebellious, passive aggressive
6. Ethical “flexibility”
7. Reduced loyalty
8. Entitlement – narcissism (ego/self-image)
9. Minimising their mistakes or faults
10. Inability to assume responsibility for their actions
11. Intolerance of criticism
12. Self-perceived value exceeds performance
13. Lack of empathy
14. Predisposition towards law enforcement
15. Pattern of frustration and disappointment
16. History of managing crises ineffectively
Accordingly, the US Department of Homeland Security suggests that behavioural indicators of malicious threat activity may include:
• Remotely accessing the network while on vacation, sick or at odd times
• Working odd hours without authorisation
• Notable enthusiasm for overtime, weekend or unusual work schedules
• Unnecessary copying of material, especially if it is proprietary or classified
• Interest in matters outside of the scope of their duties
• Signs of vulnerability, such as drug or alcohol abuse, financial difficulties, gambling, illegal activities, poor mental health or hostile behaviour.
• Other warning signs include the acquisition of unexpected wealth, unusual foreign travel, irregular work hours or unexpected absences
No single behaviour may indicate malicious intent. Employees should avoid investigating colleagues themselves, and refer to their organisation’s security or human resources teams.
Further Reading:
