By: Sean Robinson, Program Chair, Predictive Analytics World for Government

 

In anticipation of her upcoming panel discussion, Insider Threat Panel, at Predictive Analytics World for Government, Oct 13-16, 2015, we asked Patty Larsen, Co-Director, National Insider Threat Task Force, a few questions about her work in predictive analytics.

 

(NOTE: Since the NITTF oversees the Executive Branch’s implementation of insider threat programs, we have unique insight into the great work being done in the community to leverage predictive analytics to detect insider threats. These responses reflect that community-wide perspective.)

 

Q: How would you characterize your agency’s current and/or planned use of predictive analytics? What is one specific way in which predictive analytics actively drives decisions in your agency?

 

A: We traditionally react to insiders by investigating their actions after the fact, but by then it is too late. Now, with increased access to data, more behavioral science research, tested algorithms, and advanced analytic tools, we can be more proactive and get ahead of the curve…which is good because a malicious insider can do a lot of damage a lot more quickly than in the past.

 

Q: Can you describe the challenges you face or have already overcome in establishing a data-driven environment in your agency?

 

A: Insider threat programs focus on anomalous activity, they don’t profile people. That’s why using de-identified data first to find concerning patterns of behavior, and then attributing it back to a person, is a best practice.

 

Q: Can you discuss any near term goals you have for improving your agency’s use of predictive analytics?

 

A: We can gather a lot of data that may indicate an insider threat, but need to keep in mind that those actions are committed by a human being with certain proclivities, biases, and perspectives. To put those actions into context, we need to marry up behavioral science with the data to better answer not just what happened, but why.

 

Q: Can you describe a successful result from the employment of predictive analytics in your agency, i.e., cost avoidance, funds recovered, improved efficiency, etc.

 

A: One of the challenges of insider threat is measuring something not happening. To prove causality between a solid program and the prevention of an insider threat incident is very difficult. However, we have seen instances where predictive analytics have identified troubled employees and enabled management to step in and help before they took the final irrevocable step – be it workplace violence, suicide, espionage, or sabotage.

 

Q: Sneak preview: Please tell us a take-away that you will provide during your talk at Predictive Analytics World for Government.

 

A: Data is just data, but data put into context is priceless.