Insider risk in insider threat detection is uncomfortable to discuss and expensive to ignore. Guard force performance on the practice within corporate security practice reflects supervision, not instruction. It is appropriate for those preparing to take on wider responsibility for this part of corporate security practice. Participants leave with a method for insider threat detection, not a set of opinions about it. Sessions alternate between guided analysis of the corporate security practice discipline and supervised application. The outcome is a practitioner who can hold a position on the corporate security practice capability and revise it on evidence. Mature organisations treat insider threat detection as a standing capability rather than a project that finishes. The version of this part of corporate security practice described in the manual and the version practised on the floor tend to diverge over time. The programme closes with an action plan for this area of corporate security practice that each participant writes for their own organisation.
Expected Learning Outcomes
✓
Exercise and test arrangements for insider threat detection under realistic conditions.
✓
Establish what evidence would demonstrate that insider threat detection is under control.
✓
Protect information and intellectual property within insider threat detection.
✓
Balance security requirements in insider threat detection against operational practicality.
✓
Review contracts and agreements for the obligations they create around insider threat detection.
✓
Build the security operating procedures governing insider threat detection.
✓
Diagnose whether a problem in insider threat detection is one of design, resourcing or discipline.
Who Should Attend
✓
Analysts producing the data on which decisions about insider threat detection rest.
✓
Business continuity and crisis managers covering insider threat detection.
✓
Managers of multi-site operations seeking consistency in insider threat detection.
✓
Facility and site managers accountable for protection of insider threat detection.
✓
Information security staff whose remit overlaps insider threat detection.
✓
Contract managers overseeing outsourced security in insider threat detection.
Course Modules
Open any module to see its sessions and topics.
01
Insider threat detection: procedures, access control and identity
2 sessions · 8 points
Session 1Handling evidence from insider threat detection so it survives scrutiny
Close out actions on insider threat detection rather than leaving them open indefinitely.
Map the handovers in insider threat detection between functions and secure them.
Review insider threat detection after every incident, exercise or change in threat.
Coordinate arrangements for insider threat detection with civil defence and police in advance.
Session 2Testing insider threat detection before relying on it
Set out the decisions in insider threat detection that require sign-off and by whom.
Build the threat picture for insider threat detection from sources relevant to this site and sector.
Establish who is informed, consulted and accountable in insider threat detection.
Compare the cost of insider threat detection with the cost of its absence.
02
Insider threat detection: incident response and escalation
2 sessions · 8 points
Session 1Coordinating with external authorities on insider threat detection
Establish the boundary of insider threat detection and record what sits outside it.
Review surveillance coverage for insider threat detection against likely approach routes.
Reduce the variation in how insider threat detection is carried out between teams.
Remove steps in insider threat detection that add effort without adding assurance.
Session 2Assessing the threat to insider threat detection specifically, not generically
Prepare the summary of insider threat detection that senior management will read.
Define the first response actions for an incident involving insider threat detection.
Establish evidence handling and chain of custody for insider threat detection.
Assess contractor and third-party exposure within insider threat detection.
03
Insider threat detection: vulnerability assessment and prioritisation
