Malicious insider threat in an organization, and the consequences of their actions

One account claimed that a delegation of angry workers went to Natalie’s office and demanded to know when the machine would be properly installed. The Facilities Queen responded (they claimed) that “if it brewed coffee, then it’s working properly” and acidly declared there would be no effort invested in putting the brewer on a counter where it belonged, morale be damned.

To add insult to injury, the awesome new brewer makes horrid coffee, no matter which varietal is chosen. They’re all awful. Accordingly, no one in the facility has ever used it more than once. That factor alone constitutes adequate cause for the construction of a guillotine in my opinion.

To return to my opening question: if an essential leader in your organisation – like Natalie, the Facilities tyrant – supervised a project that delivered a completely unusable new coffee brewer, would you assume that Natalie was incompetent? Or malicious? Both?

For my money – and please remember that I’m getting all this second-hand – a villain like Natalie qualifies as a malicious insider threat. For me, the key “tell” in the story is that once the installation was botched and reported, Natalie declined to do anything to fix it. At that moment, the possibility of ignorance being the culprit went right out the window. Natalie’s was an act of wilful spite, full stop. One that’s sure to cause follow-on negative consequences, like unprofessional behaviour, tardiness, and preventable accidents. Possibly even a fistfight or two.

This story shouldn’t be treated as an isolated incident. Disgruntled employees like Natalie are found everywhere. They’re also neither subtle nor cunning; everyone who works with them knows what they’re about. If you have a “Natalie” in your organisation, know that they’re doing to your workers’ morale what a dysentery outbreak does to the office lavatories.

What’s fascinating about this example, I find, is that most security professionals don’t consider a monster like Natalie to be a true insider threat! That’s because she’s not interested in stealing money, classified information, and/or equipment from the company. Instead, a Natalie is classically disgruntled and, if unchecked, will make everyone else’s life at the office miserable. She doesn’t need to steal anything, but she is wilfully harming the business. So why doesn’t she count?

My hypothesis is that most insider threat programmes are too narrowly focused on technology and don’t factor simple behaviour as something that requires intervention. If a Natalie says something bigoted over email, IT or Security can act on it as a violation of the organisation’s Acceptable Use Policy. If Natalie says the exact same bigoted thing to someone in person in the breakroom, that’s HR’s problem; IT and Security won’t get involved.

That’s a mistake. I personally believe that the remit of an insider threat program should cover the entire range of human behaviour, not just things that require a computer. That’s a tall order, I know, but … consider just how badly productivity would plummet in your office if Natalie fouled up your only coffee machine. Rancid behaviour away from the keyboard is still rancid behaviour, and needs to be sorted sooner rather than later.

First, though, I need a refill. All this talk of “no coffee” is making me twitchy.

^[1] The way the tale was told, it sounded like a “Revolution Touch” automatic espresso machine or something similar.