Detecting and dealing with the threat from within

[kscarbel2]

Fleet Owner / December 3, 2015

In many ways, the horror of the shootings in San Bernardino, CA, is compounded by the knowledge that the main perpetrator – alleged to be Syed Rizwan Farook – attacked his fellow workers at a holiday party.

Indeed, police noted that 28-year old Farook and his accomplice 27-year old Tashfeen Malik used high-powered rifles and pistols to kill 14 and wound employees of the San Bernardino County Public Health Department – the place where Farook worked for the past five years.

That’s the truly scary part, in some ways – that this murderer worked side by side with his future victims for years, with no outward sign of the tragedy he would ultimately create.

Such “internal threats” are sadly becoming more common – and may yet become more common still as employment background check rules are being altered by the federal government.

For example, note this story written by Roy Maurer with the Society for Human Resource Management (SHRM) earlier this week, which reviews a proposed rule being crafted by the Office of Personnel Management (OPM) prohibiting federal agencies from asking applicants about their criminal background information until they are referred to a hiring manager.

That proposed rule, pegged to be issued May 2016, results from a directive issued by President Barack Obama Nov. 2 to remove from federal job application forms the check box requiring applicants to indicate if they have a criminal history, and delay criminal history inquiries until later in the hiring process—a practice that is commonly known as “banning the box.”

Under the proposed legislation, once a conditional offer of employment has been made, an employer would be permitted to ask about the applicant’s criminal record and revoke the offer based on the results of a criminal background check – though the proposed law includes exceptions for “sensitive positions,” including law enforcement and national security positions, SHRM’s Maurer noted.

Yet critics like Mike Coffey, president of national background screening firm Imperative Information Group, said such legislation places an “unfair burden” on employers.

“Ban-the-box advocates are winning the rhetorical battle by falsely suggesting that employers’ criminal history inquiries are merely check boxes without any opportunity to provide offense details and that employers, when they see a checked box, routinely eliminate the candidate without any additional consideration,” Coffey explained.

“The allegation is that employers view a 10-year-old shoplifting conviction the same as a 2-year-old sexual assault conviction,” he added. “If an employer isn’t going to hire someone because of the risk associated with past conduct, the level of charm a candidate brings to the interview should not and typically will not change the ultimate outcome.”

Indeed, check this list out in terms of how more restrictions are being placed on the hiring processes used by companies.

More critical to this discussion is how “internal threats” are increasing in terms of potential criminal activity, if not violence.

Take a survey conducted among 337 corporate executives by background screening firm First Advantage this summer, which found that “most important security controls” for thwarting cybercrime isn’t anti-malware software or beefed up physical security measures but better background checks of current and prospective workers.

“The fact is that an initial background check does not protect an organization in perpetuity,” noted Mark Silver, chief security officer at First Advantage. “In order to better protect against potential insider-driven breaches, periodic re-screening should be done.”

According to the firm’s poll, 60% of respondents said employee background screening is “the most important security control” that can be put in place to protect organizations, followed by anti-malware (53%) then physical security and physical access controls (39%).

When asked about the importance of background screening of new employees in preventing security risks, 98% agreed that it was at least “somewhat important” with 57% saying it is “extremely important” to do background checks.

Not only were background checks of new employees deemed highly essential, but the process of doing background checks periodically on existing employees also received high marks, Silver added, with 35% calling the process “somewhat important,” with 17% selecting “very important” and 19% characterizing employee re-screening is “extremely important.”

Yet when asked how often employees are re-screened, a clear majority of those polled by First Advantage, some 61%, said that the practice is never done at their workplace, with only 13% of respondents re-screening them annually and 10% doing so every other year.

However, would such frequent “re-screening” allow companies to potentially detect – and hopefully defuse – a worker making deadly plans? That’s a tough question to answer, considering hindsight is always 20/20, while future predictions are not.

We’ll talk more about that angle in tomorrow’s post.