Free EU-funded eLearning platform on Insider Threat now live

Brussels, 10 January 2019 - After 2 years of intense work, the outcome of the Insider Threat project co-led by Securitas, DHL, Palmyra Aviation Advisors and CoESS becomes available to all players in Critical Infrastructure. Help2Protect.info is an online platform hosting two sets of eLearning tools: an Awareness Training and an Insider Threat Program Builder.  The target audience is mainly transportation and energy ecosystems, but also other types of Critical Infrastructure.  The ultimate objective is to help Infrastructure Operators enhance their resistance against Insider Threats.

If you think that the Insider Threat is not your problem, think again.  Companies like British Airways, Belgium’s nuclear power in Doel, the French CERN Large Hadron Collider, and many more around the world, have been the target of Insider Threats’ attempted sabotage, which – if they had been successful – could have caused major damage and casualties.

Mitigating the Insider Threat, in particular in Critical Infrastructure, is therefore one of the top priorities of the European Commission and, as a result, one of the hot topics that CoESS (the European organisation representing the national private security associations) has been busy with for the last four years.

So, what is ‘Insider Threat’?

Defining the Insider Threat is relatively simple: it is anyone who can have access and damage your organization. Whilst the vast majority of employees are loyal and honest, a very small but potentially very dangerous minority may try to damage your organisation for a variety of reasons.   The threat may also come from sub-contractors, consultants, interim and temporary staff.

Whilst jihadist terrorism is a very obvious source of concern nowadays, the Insider Threat is not just about ideology-driven attacks. It can go from petty theft to wide-scale espionage, from the employee stealing consumables to people stealing crucial data and leaking it to the rest of the world (e.g. Edward Snowden, who was a sub-contractor for the CIA). It can also go from minor sabotage by disgruntled employees, to the same becoming active shooters on their (former) workplace.

Trying to find facts and figures about the Insider Threat in the EU is not easy. One of the reasons is that, because many companies don’t have an Insider Threat programme in place, they are unlikely to detect them until they have caused major incidents.

The aviation industry is particularly vulnerable because it has been the target of terrorist attacks since decades, and the possibility of having help from the inside is therefore very attractive. With little resources, great damage can be done.

7,000 items stolen daily

On the other side of the Atlantic, the Transport Security Administration (TSA) has made some figures public: for example, around 7,000 items are stolen each day from checked luggage in security restricted areas; 5% of the total airport ID cards are missing in the USA, some of them probably still active. This represents several thousand cards. Whilst the Insider Threat is not the most numerous type of threat, with about 1,900 reported incidents in the last ten years, it is the most costly and damaging kind, with an average cost per incident of EUR 400,000.

The Jihadist threat (foreign fighters and so-called returnees) is still the key threat, but Europol’s TE-SAT also lists amongst future trends right-wing extremism and ethno-nationalist terrorism. Against this background, the European Commission has been organizing events and publishing documents since 2015, highlighting the threat and seeking to find best practice to counter it. Whilst there is a vast body of literature about it – from specialized agencies like the FBI, CERT (EU Computer Emergency Response Team) or the CPNI (British Centre for the Protection of National Infrastructure), consultants, or experts in this field – there was, until now, no free, accessible to all, web-based training in the EU that could be used in order to raise the awareness of a very wide and varied public, such as the people who work in airports. The Help2Protect training modules are designed to close this gap.

Web-based modules

In response to the call for applications for EU Funds (Internal Security Fund) in 2015, Securitas, DHL, Palmyra Aviation Advisors and CoESS partnered up to produce two web-based modules aimed to the transportation ecosystems, such as aviation, and transposable to other critical infrastructure environments, such as energy. The project lasted two years and its deliverables have been made available just before the end of 2018.

The team organized fourteen workshops and digested a vast number of documents, books, and manuals into two simple and easy to use modules. The first one is an awareness module, aimed to any worker and employee working within or with a CI. The second one is a thorough Insider Threat policy builder aimed to executives who need to build their own Insider Threat Programme from scratch. Some templates are also available, as well as a downloadable PDF manual to make these Executives’ work as easy as possible.  

Multiple protection purposes

The ultimate goal of Help2Protect is to engage all stakeholders to protect themselves, their colleagues, their company and the infrastructure they work for. The Help2Protect modules are designed to make sure that the Critical Infrastructure are able to function smoothly, without unwanted disruption and are well protected for the good of society.  This implies spotting and stopping those who seek to harm them before it is too late.

The modules have been designed by Splintt, a Dutch eLearning company and are hosted here: https://help2protect.info

Information about the project and its partners can be found here: https://help2protect.info/wp-content/uploads/2018/12/coess_background-information.pdf

For any further information or queries, please contact us at Help2Protect@coess.eu

Follow