Operations Security and Insider Threat Awareness Training Course

If you work for, support, or have authorized access to Department of Defense resources, your day-to-day decisions help protect people, missions, facilities, systems, and information. This comprehensive training introduces two closely connected security concepts: Operations Security (OPSEC) and Insider Threat awareness. At an awareness level, OPSEC is a straightforward process: you identify sensitive or critical information, recognize where and how it might be exposed, assess the risk of that exposure, and use countermeasures to protect it. It requires you to view your daily operations through the eyes of an adversary and remove the vulnerabilities they might exploit. A foundational concept within OPSEC is information aggregation. Individually, a single detail like a supplier name, travel schedule, minor technological spec, or facility layout might seem completely harmless. However, when adversaries collect and combine these unclassified, seemingly trivial details from multiple sources, they can reveal critical capabilities, schedules, technologies, locations, personnel, or vulnerabilities. Therefore, OPSEC principles must be applied at conferences, trade shows, during work travel, and in social media postings.

Transitioning to Insider Risk Awareness, it is vital to understand that an insider is a person with authorized access to government, organizational, or customer resources, such as personnel, facilities, information, equipment, networks, or systems. An insider threat is the risk that an insider may use authorized access—intentionally or unintentionally—in a way that harms U.S. security, organizational resources, people, missions, systems, or information. Notice that this includes both deliberate and unintentional misuse. Intentional misuse can include espionage, sabotage, targeted violence, or deliberate unauthorized disclosure. Unintentional misuse can include mistakes, negligence, or failures to follow security procedures that expose protected information or degrade organizational resources. An insider threat is not a label to apply to a person; it is a risk that trained personnel assess using reliable information, appropriate procedures, and applicable privacy and civil-liberties protections.

Foreign intelligence entities, competitors, criminal actors, and other adversaries may seek nonpublic information from people with access to it. Their approaches can include unexpected requests for information, academic or research inquiries, social-media outreach, conference conversations, or job offers. If you observe concerning behavior, such as attempts to obtain information without a work-related need, improper copying or removal of protected information, repeated efforts to bypass controls, unauthorized use of removable media, or sensitive-data hoarding, you must report the facts through the designated process. Do not investigate independently, confront the individual, search someone's workspace or device, access systems beyond your authorization, or discuss the report with coworkers. Finally, this course clarifies that reporting suspected waste, fraud, abuse, corruption, or dangers to public health and safety through authorized channels is protected whistleblowing, not an insider threat.

This program is available with English and French closed captions.