Feds to Unveil Insider Threat Defense Plan by Year End

04.04.2012

Officials formulating the guidelines for deterring insider threats sought to downplay the impact their work would have on agency operations, and noted that they are seeking input from all corners of government to ensure they arrive at a practical implementation strategy that will prevent another WikiLeaks-like episode without establishing an onerous compliance burden or trampling on government employees' privacy or civil rights.

"On a macro level almost you can't be looking at one aspect of this directive. You have to be looking at systems and people," said the FBI's Diana Braun. "In other words, nobody's sitting in an ivory tower and coming up with policies that aren't possible to implement in the field."

Braun explained that the task force is not approaching the issue of insider threats with a "one-size-fits-all" mentality, but will provide agencies with some flexibility to implement the standards in accordance with the nuances of their organization.

What's more, members of the task force are urging agency heads to continue to evaluate and strengthen their existing procedures for detecting insider threats ahead of the final directive, noting that any government arm that handles or accesses classified data should already be acting in concert with a set of best practices. Even though the final standards and guidelines from the task force aren't due out until October, the administration has already tasked agencies with firming up their stance on other factors often involved in a data breach, such as the policies governing removable media, online identity management, access control and enterprise auditing.

"No agency is starting from scratch. That's the good news," Swift said. "It's going to take a while before agencies have a hard set of written standards to follow."