Insider Threats and Personnel Security

NUCE 304: Evaluative Methods for Nuclear Non-proliferation and Security

• Course title: NUCE 304: Evaluative Methods for Nuclear Non-proliferation and Security
• Course subtitle: Nuclear Security (Part 1)
• Instructor: Dr. Ahmed Alkaabi

Introduction to the International Nuclear Security Regime

• The presentation introduces the international nuclear security regime.

International Security Regime Timeline

• Key dates and events in the international nuclear security regime are shown
• The timeline highlights various IAEA activities and summits related to nuclear security.

Risk of Nuclear Material

• The risk of nuclear material being used in criminal or intentional unauthorized acts is a significant concern for international security.
• IAEA Nuclear Security Plan (2014-2017) emphasizes this risk.

Non-Proliferation Goals by IAEA

• The IAEA aims to secure nuclear and radiological material in use, storage, and transport.
• The IAEA assists states in implementing international legal instruments for nuclear security.

State's Nuclear Security Regime

• The overall objective of a state's nuclear security regime is to protect people, property, society, and the environment from malicious acts involving nuclear material or other radioactively materials. (INFCIRC/225/Rev/5, Section 2.1)
• Physical protection is a cornerstone of this regime.

Nuclear Security Regime

• An effective nuclear security infrastructure requires a multi-disciplinary approach, including clearly defined legal and regulatory systems, human resource development, established procedures, and technical support at regional, national, and facility levels.

Nuclear Security International Guidelines

• Nuclear Security Fundamentals outline objectives, concepts, and principles of nuclear security.
• Recommendations provide best practices for Member States.
• Implementing Guides help in applying Recommendations and suggest implementation measures.
• Technical Guidance includes Reference Manuals, Training Guides, and Service Guides to support practical implementation.

Nuclear Security and Local Authority

• Illustrates the interconnectedness of various levels of authority involved in nuclear security, from the individual to the state level.
• Each level complements others to ensure integrated approach to nuclear security.

Summary

• Nuclear and radioactive materials pose a significant threat.
• The international security regime uses international legal instruments at the national and facility level.
• Best practices for nuclear security are applied at international, state, facility, and individual levels.

Insider Threat Analysis

• This section details the analysis of insider threats.
• Insiders, with authorized access to nuclear facilities or materials in transport, may undertake malicious acts or assist external adversaries.
• Different categories and types of insiders are detailed including potential motives and traits.

Insider Definition

• Insiders are individuals authorized to access nuclear facilities or material in transport.
• Insiders include management executives, regular employees, security personnel, service providers, visitors, and inspectors.

Insider Categories

• Insider categories are categorized based on their motivation - internally motivated or externally coerced - and their willingness to use force: passive, non-violent, active and violent.
• All insiders can use stealth and deceit.

Insider Attributes

• Insider attributes include authorized access to nuclear facilities or transport, authority over personnel and operations, ability to acquire tools, equipment, weapons, or explosives, and technical skills and expertise.

Insider Access

• Authorized access to work areas, special temporary access, escorted or unescorted access, emergency access, and potential unauthorized access conditions are discussed.
• Assessing vulnerabilities specific to insider access is emphasized.

Insider Authority

• Insider authority over people involves designated authority, personal influence , and authority over tasks and equipment.
• Different types of authority (assessment of alarms, processes, and procedures) are important factors in understanding insider motives and actions.
• Temporary and falsified authority, and coercion are also included.

Insider Knowledge

• Insider knowledge involves targets (locations, characteristics, and facility layouts), security systems (force capabilities, and communications), bypass detection equipment, and related special tools.

Opportunity

• Insider opportunity is linked to access, authority, and knowledge.

Insider Motivations

• Political, ideological, financial, and personal motivations are discussed.
• Key examples of insider motivations to highlight the diversity of potential causes are given.

Factors Affecting Insider Attempt

• Factors affecting the potential insider attempt include access, authority, knowledge and opportunity, combined with political, ideological, financial, and personal motivations.

Insider Advantages

• Access to time, tools, tests, and potential teamwork for insider attacks are listed

Insider Definition Summary

• Insider categories (passive, active non-violent, active violent), facility insider characteristics (access, authority, knowledge, and motivation), and insider advantages (time, tools, tests, and teamwork) are presented.

System Approach to Prevent and Protect Against Insiders

• A 5-step approach to preventing and protecting against insider threats is presented.

Introduction to Personnel Security Programs (PSP)

• Introduction to Personnel Security Programs (PSP) is covered.

Nuclear Security Threats and Risks

• Nuclear research and energy pose risks: accidents, sabotage, theft, and use in malicious devices.

The Human Dimension and Insider Threats

• Personnel have positive and negative roles concerning nuclear security risks.
• Lack of awareness, negligence, accidental acts, and malicious acts (insider threat) are examined.

Look Familiar?

• The presentation and steps to protect against insider threats are visualized.

PS Implementation Framework

• PSP implementation frameworks and four basic elements: Threat and Risk Assessment, Personnel Security Requirements, PSP Implementation, and Review and Assessment.

Threat and Risk Assessment

• Developing a Personnel Security Program (PSP) should be informed by an assessment of threats and risks.
• Assessment of potential adversaries, types of nuclear materials, and exploited opportunities for insiders.

Graded Risks

• Grading the depth of trustworthiness checks should correspond to the level of individual access.

Personnel Security Requirements

• Informing security policies by threat and risk assessment.
• Requirements involve access levels (e.g. clearance levels, access to specific areas), eligibility criteria, and the "need-to-know" principle.

PS Implementation

• Implementing pre-employment processes that include interviews, background checks, and psychological and medical evaluations, regular file reviews, and resolution mechanisms.

Personnel Screening Process

• The aim of preventive measures is to exclude potential adversaries and minimize insider threats.
• Measures include identity verification, trustworthiness assessments, escort and surveillance, confidentiality, and sanctions.

1. Identity Verification

• Identity verifications confirm the individual's identity.

2. Trustworthiness Assessments

• Trustworthiness assessments assess an individual's pre-employment integrity, and behaviour during employment.
• Pre-employment checks include criminal records, references, work history, financial records, medical records and psychological examinations.
• Periodic checks are crucial.

2. Trustworthiness Assessments (continued)

• Periodic checks are essential to identify unusual behaviors.

3. Escort and Surveillance

• Escort and surveillance involves closely overseeing personnel.
• This is important to ensure they perform their tasks properly within their access limits.

4. Confidentiality

• Information on security measures and sensitive targets should be kept confidential, limited to those with a need-to-know.
• Compartmentalization of sensitive facilities and activities is crucial.

5. Sanctions

• Employees should understand that breaching security policies result in sanctions and disciplinary action.
• Deterrent to malicious acts.

PS Implementation

• Requirements are translated into implementation programs with standardized personnel screening processes.
• Processes potentially include pre-employment interviews, background checks, investigations, psychological and medical evaluations, and adjudication measures for handling disputes amongst others.

Implementation Cycle

• PSP implementation is not a one-time event.
• The security program should adapt to evolving threats, and new capabilities, technologies and materials.

Information Security Analysis

• Information security protects sensitive nuclear-related information from theft and malicious use.
• The growth in electronic information networks, risks of unauthorized access, and heightened need for information effectiveness protection present challenges.

Nuclear Information Security – IAEA Description

• Unauthorized disclosure, modification, or alteration of sensitive nuclear-related data could compromise security.
• This applies to facilities, programs, and other related areas.

Nuclear Information Security – WINS Description

• Awareness of sensitive nuclear-related information risks.
• Implementing measures to properly manage nuclear information.
• Preventing unauthorized access and use of materials, facilities.

Nuclear Information Security – NRC Description

• Classified and sensitive information regarding the physical protection of nuclear material is protected against unauthorized disclosure.
• Protection for power reactors and related materials is essential.

Information Security – Levels, Access, Classification, & Handling

• Information security involves classification, marking, and protection of sensitive information.

So, What is Information…?

• Information comprises concepts, events, processes, facts, patterns, etc.

Forms & Types of Information

• Information comes in many forms (paper, electronic, verbal, written, etc).

Typical Nuclear-Related Information that Needs Protection

• Information protecting nuclear materials, sensitive technology, procedures, facility, physical protection, IT security, transportation, design threat analysis, emergency procedures and access control.

Key Steps to Take for Information that Needs Protection

• Identifying, classifying information, marking it, access control, storing, protecting, retaining, or declassifying information.

“Need-to-Know” – NTK

• The "Need to Know" principle ensures only authorized personnel have information for their official duties.

Importance of Training

• Personnel must master security principles for consistent compliance.

Summary

• Achieving information security assures protection of sensitive nuclear-related data from any malicious use.
• Relevant types, forms and steps for information protection are included.
• The importance of "need to know" and training for consistent compliance.

This quiz explores the concept of insider threats in organizations, particularly within personnel security programs. It addresses common misconceptions, challenges in implementation, and critical factors necessary for effective security strategies. Test your understanding of the implications and strategies surrounding insider threats, especially in sensitive environments such as nuclear security.