Workplace Violence and IT Sabotage: Research Review 2016 Two Sides of the Same Coin?

We set out to Determine if coherent, Prevalence Coding for Stressors. integrated, and validated indicators of Physical The clearest commonality between all the manifestation coding factors were the categories of stressors for Insider Workplace Violence (WPV) Workplace that the perpetrators experienced. These were and Insider Cyber Sabotage (ICS) can Violence coded into six major categories: personal, be identi ed. Predispositions Stressors Concering Attack nancial, mental health, work, relationship, and Behaviors Execution work relationship. Two areas that were Reason: If there are common indicators signi cant in both WPV and ICS were work and organizations may be able to develop Resolving conict Perceived Verbal threats Unauthorized work relationship stressors; two areas that socio-technical controls that prevent, detect, using physical harrassment of physical weapons organizations could have the greatest inuence and help respond to both threats without means by coworkers harm at work over. identifying which crime will eventually be committed. Approach: Collect, code, and analyze cases of Incident Stressor De nitions Hiring Timeline WPV and compare them to cases of ICS in the Personal Self-esteem, con dence, insecurity, CERT Insider Threat Center’s corpus. nervousness, disagreeableness, etc. Financial Debt, insuf cient income, loss of bonus/promotion/raise Coding & Analysis Member of Losing control Visiting hacking Introduction Relationship Family, friends, enemies We coded WPV & ICS cases for personal hacking of system websites of malicious (not workplace related) community evolution code predispositions, stressors, concerning Mental Health Clinically diagnosable issues (even if not diagnosed at the time behaviors, problematic organizational they were observed) responses, and the hostile act to identify a Work Job security, performance, unmet common incident pathway. expectations, disgruntlement Average behavior Range of behavior Cyber (with co-workers, supervisors, or Sabotage the organization) Prevalence of Work Relationship Aggression, disagreements, bullying, Cyber manifestion isolation, inability to form cohesive work relationships due to personality WPV & ICS Incident Pathway WPV and ICS Pathways Comparing Stressors for The pathways were most common in areas of Execution of Active shooter predispositions and stressors. Concerning ICS & WPV malicious code Hostile behaviors was usually the earliest point were Stressors for Insider Stressors for Act organizations might be able to determine if a Cyber Violence Workplace Violence 12% 12% Demotion without Problematic Reprimands following long history hostile act might manifest as WPV or ICS. 21% changing access of inappropriate behavior Organizational 31% Responses 13% Visiting internet Verbal threats to underground Concerning Behaviors cause physical harm 0% 8% Lack of resources Perceived harrassment 1% Stressors 5% to do job well by coworkers 51% 10% 36% Resolving conict by Hacker Personal Relationship Personal Predispositions physical means Work Mental Health CERT, 2006 Financial Work Relationship Key: ICS WPV

Distribution Statement A: Approved for Public Release; Contact: Michael C. Theis [email protected] Distribution is Unlimited P16