Photo By Quinetta Budd | James Shappell - DOD Insider Threat Management Analysis Center (DITMAC) Director at...... read more read more
Subscribe
WASHINGTON – A Defense Counterintelligence and Security Agency (DCSA) leader challenged his fellow insider threat professionals from military, government, industry and academia with one question at the two-day Defense Strategies Institute (DSI) 2023 Counter-Insider Threat Symposium.
“What can you take back to your program that's going to make it better?”
“It’s my challenge to all of you,” said James Shappell, DOD Insider Threat Management and Analysis Center (DITMAC) Director at DCSA as the first guest speaker on Sept. 27 while describing DOD's vision for countering insider threats. “Find one nugget. It doesn't have to be from a presenter. It can be in a conversation that you have. It can be from one of the amazing vendors here. It can be from one of your partners who don’t specialize in countering insider threat but are present from the counterintelligence or security perspective.”
At that point, Shappell himself suggested nuggets for his audience to consider taking back to their respective counter insider threat programs at military commands and DOD agencies as well as businesses, corporations and educational institutions in cleared industry and academia.
“This year’s theme is ‘Bystander Engagement’ for National Insider Threat Awareness Month (NITAM), so part of that is getting information and guidance to the bystanders,” said Shappell, regarding the impact of bystander engagement on workforce safety and national security as individuals are empowered to act earlier when identifying concerning behaviors. “Help them understand the Insider Threat program and its value – what we do with the information and how we are there to try to help people. Particularly, the people who are the unwitting insiders. The malicious ones we know. That's a separate issue. We've got to deal with that as well, but how do we help the people who can't help themselves? How do we make sure that the programs are in place to support them? When our organizations see programs that are supportive, we’ll gain additional momentum. People will want to be a part of the program.”
Shappell – former National Intelligence Council chief of staff at the Office of the Director of National Intelligence – described DITMAC’s support via its new Prevention, Assistance and Response (PAR) program as it hired, trained and assigned PAR coordinators to DOD joint bases and regions throughout the country in 2023. Now, PAR coordinators are working with functional experts at the installations while supporting commanders and equivalent civilian leaders in the development of informed, risk-based decisions earlier in the process of insider risk.
Momentum continues building as the PAR cadre engage their local military communities with briefings and training sessions on reporting and indicators of violence to help individuals understand when problems may be arising. Shappell explained how PAR coordinators work closely with prevention and human resource experts to ensure military and civilian leaders are aware of the various services available, such as financial planning, marriage counseling and other employee assistance programs, while assisting their personnel in dealing with any friction points in their lives that are causing them to act or behave violently. In terms of response – if PAR professionals learn that an individual is beginning to escalate further down the path of violence – they will work closely with law enforcement, security and leadership to better understand the risk and help develop potential mitigation measures to stop the threat.
“PAR coordinators have reach-back capabilities to our Behavioral Threat Analysis Center (BTAC),” said Shappell. “Within BTAC, we've got behavioral psychologists, cyber experts, law enforcement, counterintelligence, threat assessors, threat managers, and employee relations managers.”
Threat assessment is a unique discipline requiring expertise the BTAC team provides to assess an individual and determine the scope, intensity and possible consequences associated with a potential threat. The assessment is based on behaviors, not profiles; and behaviors are variable and complex in nature. The ultimate goal of a threat assessment is to prevent an insider incident, whether intentional or unintentional.
Throughout his presentation, entitled ‘DOD Vision: Countering Insider Threat for the Current and Future Threat Landscape,’ Shappell outlined DITMAC’s support while unfolding the complexity of DOD insider threat.
“I'll give you an idea of what that complexity looks like from our perspective and that will help you to understand some of our challenges as we look at the current and future threat environment within DOD,” said Shappell, noting that the 47 DOD components and 43 insider threat hubs look at insider threat challenges from a different perspective.
“The Defense Commissary Agency (DeCA) is looking at it (trusted insider risk and threat) very differently than the National Reconnaissance Office (NRO),” said Shappell. “They're trying to protect two different things, but their challenges are not as different as they might think. DeCA may not be as interested in user activity monitoring as NRO, but they could certainly use human resource related data just as well as NRO could use that information. It’s helpful for the DeCA to have data from a security perspective just like it’s advantageous from NRO’s perspective. So, some of the challenges are the same across the department and others are not.”
Meanwhile, DCSA personnel security, industrial security, counterintelligence and insider threat experts - engaged in resolving myriad transparency, information sharing and other challenges - are observing each of the different DOD components and how they work day-by-day.
“We receive information or reporting from each component and try to cross level that information and work towards analyzing and mitigating that risk from those trusted insiders,” Shappell explained. “We also have silos to break down and it's not just within each component and their human resources while trying to access that information. It's the same challenge that you're running into, probably at your own station. How do you get access to that data? How do you show them the value of giving the data? What are you giving back to them?”
The former Army intelligence analyst described the positive influence of DITMAC’s PAR program on workforce culture and its capability to garner information and access data via full time coordinators engaged with commanders and the community to prevent, counter and mitigate insider threat at the local installation level.
“Our PAR program is designed to give commanders the right amount of detail and information so they can make informed, risk-based decisions on how they should best move forward to support their personnel,” said Shappell. “We were very fortunate to have the opportunity to implement PAR at the joint bases and regions across the Department of Defense in the last year. PAR coordinators at the bases are supporting and advising those commanders to make informed risk-based decisions and close the gaps. It's so important for DCSA to be on the joint bases because there’s a mix and match of different military services at those locations. Helping them (base commanders) understand the risk that they're facing and the mitigating opportunities available will enable people to get back to the work they need to do and feel supported while feeling they're part of the team. All of that comes back to creating the right level of culture.”
Moreover, Shappell emphasized DCSA’s posture to help mitigate risks from trusted insiders across the DOD enterprise, starting with the agency’s Personnel Security mission, which includes Background Investigations and Vetting Risk Operations with its Continuous Vetting service. This risk mitigation process concludes with the DCSA Consolidated Adjudication Services – the sole authority to determine security clearance eligibility of non-intelligence agency DOD personnel occupying sensitive positions or requiring access to classified material including sensitive compartmented information.
“We run 95% of the background investigations for the federal government and we adjudicate the security clearances for the Department of Defense,” he added. “Then we run Continuous Vetting for the Department of Defense and a large population of non-DOD entities. So, from a personal security perspective, the gatekeepers at DCSA have a great opportunity to lead the charge on stopping people from getting in the front door.”
DCSA gatekeepers include industrial security and counterintelligence professionals working to ensure the protection of U.S. critical technology and infrastructure investment.
“Our counterintelligence special agents in the field proactively impact industrial security and support DCSA industrial security representatives who oversee, advise and assist 10,000 cleared defense contractors and 12,500 industrial facilities. Now we're talking about how to stop potential insider risk within our supply chain while helping to ensure that we are prepared to fight and win our nation’s wars moving forward.”
To prevent potential insider risk, DCSA industrial security representatives inspect and monitor companies that require access to or possess classified information and controlled unclassified information associated with classified contracts to produce and provide critical technology and services for DOD.
“Then we go back into the security education training and awareness,” said Shappell as he briefed the audience on DCSA’s education mission via the agency’s Center for Development of Security Excellence (CDSE) – the premier provider of security training, education, and certification for DOD, federal government, and cleared contractors under the National Industrial Security Program.
“That is the first thing that people will send you to. If you're just getting into the security or insider threat business, they'll say go to DCSA's website and take all the courses there and that will give you a baseline,” he said, regarding the development, delivery and exchange of security knowledge CDSE provides to ensure a high-performing workforce capable of addressing U.S. security challenges. “So, we start to pull that together - the industrial security support, the personnel security support, the training and education, and the DITMAC. We've got a lot of strong capabilities to bring to the fight.”
| Date Taken: | 10.04.2023 |
| Date Posted: | 10.04.2023 17:51 |
| Story ID: | 455205 |
| Location: | WASHINGTON, DC, US |
| Web Views: | 955 |
| Downloads: | 1 |
This work, DCSA Leader Calls for Enhanced Counter Insider Threat Programs in DOD, Government, Industry and Academia, by John Joyce, identified by DVIDS, must comply with the restrictions shown on https://www.dvidshub.net/about/copyright.
No keywords found.
LEAVE A COMMENT