Candidate Screening and Hiring

Like many risks, the insider threat can often best be addressed before malicious activity can occur. For personnel, this is done before they are hired and given access to the organization's IT environment and data.

The idea behind screening is to identify candidates who may potentially harm the organization and refrain from hiring them.

There are several measures and tools that can be implemented to accomplish this:

• Crafting detailed and reliable job descriptions. The job description is an outline of desired and expected performance on the part of the employee. It will be used to determine whether the employee is performing adequately, successfully, and in accordance with the organization's governance. The job description is also the mechanism that will be used to demonstrate whether the employee violated, in some manner, the expectations and performance set out in the description. Therefore, it is important for the job description to have clear, precise annotation of these elements. For example, if an employee is terminated for acting (or not acting) in a certain way, the employee might engage in litigation to recover damages by claiming that the organization did not make the transgressive behavior known to the employee before the termination. The job description is one tool to support the organization's allegation that the employee acted improperly. Creation of the job description should be the task of the hiring manager who best understands the needs of the position and the HR department, which best understands the applicable laws and procedures for creating job descriptions that protect all parties involved.

• Checking employment history. A review of previous employment can assess the candidate's progression of responsibility, appropriate experience, and gaps in employment.
• Performing a background check. The candidate can be screened against trusted databases for suitability, such as verification of certification/credentials, educational degrees, and criminal history.

• Assessing a financial profile. For positions of accentuated trust and responsibility, it may be advised to review a candidate's financial situation. This can reveal concerns about a candidate's trustworthiness. If the candidate has too little money, it might indicate personal problems such as addictive behavior, gross poor judgment, or personal instability, all of which make the candidate susceptible to subversion should they win a position of responsibility. Too much money may indicate the candidate is already participating in illicit activity, has been paid by another entity already, or will not be responsive to the organization's requirements. A financial check usually requires the candidate's explicit written agreement and may be limited by law in some jurisdictions. Note that in some jurisdictions it may be illegal to run a credit check on an employee. However, some industry verticals in other jurisdictions demand it. As always, the security professional needs to be aware of the context in which the organization and its customers operate.

• Checking candidate references. Another way the organization can obviate the risk of hiring an unsuitable person is to determine the candidate's past performance. However, in most modern business settings, this may not lead to any particularly useful information; many organizations will not report on the performance of former employees and will only offer simplified information about the former employee's eligibility for rehire. Also, references are given by the candidate themselves, and so are not wholly independent sources.

Special Circumstances in Screening and Hiring

There may be a situation where an individual's information is unavailable, and the screening and hiring cannot be fully completed. For instance, references may not be able to be checked because a company may have gone out of business or it may have been a small company subsumed by a larger one. Another example may be when secondary school diplomas cannot be tracked down from small schools that did not have good inventory systems. It is the responsibility of the employer to use other measures to make good judgments and weigh options before making hiring decisions in these instances.