Behavioral Risk Reduction: Insider Threat Programs and Security Culture in Ukraine

Behavioral risk reduction encompasses the security controls and cultural programs that address the human dimension of cyber risk—recognizing that employees and contractors represent both a significant vulnerability surface and an essential security asset. In wartime conditions, behavioral risk takes on additional dimensions: the expanded definition of "insider threat" in active conflict includes both traditional insiders (disgruntled employees, financially motivated leakers) and agents deliberately planted by adversary intelligence services. Ukraine has developed sophisticated behavioral risk programs precisely because Russian intelligence services have actively recruited, coerced, and planted human assets inside Ukrainian organizations.

Insider Threat Landscape in Wartime Ukraine

Ukraine's wartime insider threat landscape is qualitatively different from peacetime environments. Ukrainian state security services (SBU) have documented and prosecuted dozens of cases involving Ukrainian citizens who provided targeting information to Russian forces, passed access credentials to Russian cyber operators, or facilitated cyberattacks against Ukrainian organizations in exchange for payment. Several high-profile infrastructure attacks have been found to have had an insider component—a legitimate employee's credentials or system access being used in ways that reduced the technical difficulty of the attack.

Russian intelligence has used a range of recruitment methods: exploiting financial desperation exacerbated by wartime economic conditions, coercing individuals with family members in Russian-controlled territory, cultivating social media based contacts posing as activists or researchers who gradually request sensitive information, and in some cases, direct recruitment by Russian state media employees who approached government workers with requests framed as journalism.

Insider Threat Program Components

User Behavior Analytics in Ukrainian Government

User Behavior Analytics (UBA) platforms apply machine learning to logs—authentication logs, file access logs, email logs, network flow data—to establish baseline behavioral models for each user and identify deviations that may indicate compromise or malicious activity. Indicators of concern include accessing large numbers of sensitive files in a short period, accessing systems outside normal working hours, attempting to disable security logging, unusual authentication from new locations or devices, and large-volume data transfers to removable media or external services.

SSSCIP has provided UBA guidance recommending Microsoft Sentinel's UEBA (User and Entity Behavior Analytics) capability as the primary tool for government entities already running Microsoft 365, leveraging existing licensing to add behavioral analytics without additional cost. For critical infrastructure entities with on-premises environments, Securonix and Splunk UBA have been evaluated under technical assistance programs funded by US and EU partners.

Security Culture Measurement

Measuring security culture—the aggregate of attitudes, beliefs, and behaviors that determine how employees approach security—requires instruments beyond technical metrics. The Human Aspects of Information Security Questionnaire (HAIS-Q) and the Security Culture Survey (developed by CLTRe/KnowBe4) are validated instruments used to assess organizational security culture dimensions including password management attitudes, information handling practices, compliance orientation, and reporting willingness. Ukraine's SSSCIP has incorporated culture measurement into mandatory biennial security assessments for central government ministries, with results used to calibrate training program design and identify organizational units requiring targeted intervention.

Reward Systems and Positive Security Incentives

Traditional security programs have relied heavily on punitive approaches—disciplinary action for policy violations. Research in behavioral security consistently finds that punitive-only approaches suppress reporting behavior (employees who encounter security issues avoid reporting to avoid blame) and create compliance-only cultures rather than genuine security engagement. Positive incentive programs—recognition for reporting suspicious emails, awards for identifying security vulnerabilities, team competitions for lowest phishing simulation click rates—have shown effectiveness in improving security-positive behaviors.

Ukraine's state IT department has implemented a "Security Champion" recognition program within government ministries, designating employee volunteers who receive additional training and recognition for promoting security practices within their departments. Ukraine's Diia bug bounty program has demonstrated that financial rewards effectively mobilize civilian security researchers—a model being considered for internal security champion financial incentive programs as well.

FAQ

How do Ukrainian insider threat programs balance security with employee rights?

Ukraine's insider threat monitoring programs operate within the constitutional privacy framework and require employee disclosure of monitoring as part of employee onboarding agreements. Monitoring capabilities are legally scoped to government-owned systems and government-provided devices during work conduct—personal devices and off-hours personal communications are outside monitoring scope. Logs collected through UBA systems are governed by data protection policies that limit access to trained security personnel and require documented investigative justification for individual-level review. The legal framework balances the heightened security needs of wartime with protections against political surveillance abuse.

What is the most common insider threat indicator in Ukrainian government?

Based on SBU case documentation (where details have been made public), the most commonly identified technical indicator preceding insider threat detection was unusual after-hours access to sensitive systems or files—employees accessing classified or sensitive materials significantly outside their normal working hours, consistent with accessing information for transfer to third parties while reducing the risk of in-person observation. Secondary indicators included unusual communication with foreign contacts via personal email or messaging applications using government-connected devices, and accessing large volumes of files beyond job scope requirements.

Are contractors and temporary workers included in insider threat programs?

Contractors and temporary workers with access to sensitive government systems are included in monitoring scope in Ukraine's framework, often subject to more intensive baseline monitoring than permanent employees given the shorter vetting period and weaker institutional loyalty norms. This reflects a global best practice recommendation—contractors account for a disproportionate share of insider incidents in many industries because they are subject to weaker background vetting, less organizational loyalty, and sometimes have broader system access than their specific tasks require.

What role does the SBU play in insider threat management?

The SBU (Security Service of Ukraine) has primary counterintelligence responsibility for detecting Russian recruitment of Ukrainian government insiders. SBU's counterintelligence division conducts proactive operations to identify Russian recruitment attempts, investigates suspected insider cases referred by government departments, and provides threat briefings to cleared employees about Russian recruitment approaches and recognition indicators. The SBU operates a secure reporting channel specifically for government employees who are approached by parties who may be Russian intelligence contacts, providing a pathway to report contact without initiating a formal investigation that might deter reporting.

How do DLP tools handle Ukrainian-language communications for content inspection?

Modern DLP platforms including Microsoft Purview, Symantec DLP, and Forcepoint DLP have native Ukrainian language support, enabling keyword, phrase, and pattern matching in Ukrainian-language documents and communications. Classification labels, sensitive information type definitions, and policy keywords can all be configured in Ukrainian. OCR capabilities allow DLP to scan Ukrainian text in scanned documents and images. For government entities operating entirely in Ukrainian, DLP platform language capabilities are fully adequate for the monitoring use cases required.

Sources

1. CISA — "Insider Threat Mitigation Guide," cisa.gov 2020 (updated 2023)
2. SBU — "Counterintelligence Operations Annual Review," sbu.gov.ua 2023
3. CERT-UA — "Behavioral Anomaly Detection for Government Systems," cert.gov.ua 2023
4. Carnegie Mellon CERT — "Common Sense Guide to Mitigating Insider Threats," sei.cmu.edu 7th Edition
5. KnowBe4 Research — "Security Culture Report," knowbe4.com 2024