Internet accessible behavior observation workplace assessment method and system to identify insider threat

A system for Internet web-based that identifies an insider in an organization workplace who is presenting a threat of malicious theft and damage and a non-malicious person who presents theft and damage vulnerabilities within the organization because of careless disregard for security policies by means of a user completing a workplace behavior observation form (WBOF) on an observed insider presented via an Internet web-based application, when completed, all WBOF item responses are processed by trained pattern classifiers that produce threat;

• organizational vulnerabilities, and organizational risk output values embedded in pre-specified locations within a pre-written report template thereby completing a written threat assessment that is then forwarded through Internet email as an attachment to the user's email address to assist in mitigation and comprising:
• a computer;
• a processor;
• a web-based link Via the Internet further comprising:
• analyzing collected past case examples of successful insider theft and damage within organization workplaces by a subject matter expert (SME) trained in behavior analytics and counterintelligence wherein each case is examined as one of many
• examples;
• analyzing and extracting precursor antecedents and behaviors, with all analysis completed by the SME, leading to organization theft and damage for each collected example;
• transforming antecedent precursors and behaviors leading to loss into worded items for the WBOF across all examples;
• creating data arrays with WBOF items as columns and examples used for extraction as rows and adding threat and risk outcomes for each example row;
• training pattern classifiers with examples of insider loss used for extraction whereby data arrays are created with WBOF items as columns and examples of loss used for extraction as rows;
• adding threat and risk outcomes for each example row, and embedding the completed WBOF into a website accessible by the user Via Internet and a browser;
• monitoring all items of a WBOF being rated by the user and when the WBOF is completed processes the resultant responses vector as input to trained pattern classifiers to produce threat and risk outcome values and automatically embedding outcome values into a pre-written threat assessment report template in specified locations and completing an automatically created threat report which is forwarded as an attachment to the user's email address the SME analyzes all extracted antecedent precursors and behaviors and classifies into cohesive categories by similarity with categories formed into a hierarchy whereby top-level themes with sub themes fitting a specific too-level theme are nested under the corresponding top-level theme wherein the SME then finalizes tap-level category themes into WBOF screening items and sub themes as detailed clarifying items under each screening item, words each theme into assessment item format, and adds organizational background items to finalize the WBOF for use and embeds the finished assessment form within the specific WBOF website.

A non-transitory computer-readable medium for an Internet web-based method that identifies an insider in an organization workplace who is presenting a threat of malicious theft and damage and a non-malicious person who presents theft and damage vulnerabilities within the organization because of careless disregard for security policies by means of a user completing a workplace behavior observation form (WBOF) on an observed insider presented via an Internet web-based application, when completed, all WBOF item responses are processed by trained pattern classifiers that produce threat, organizational vulnerabilities, and organizational risk output values embedded in pre-specified locations within a pre-written report template thereby completing a written threat assessment that is then forwarded through

• Internet email as an attachment to the user's email address to assist in mitigation and comprising:
• analyzing collected past case examples of successful insider theft and damage within organization workplaces by a subject matter expert (SME) trained in behavior analytics and counterintelligence wherein each case is examined as one of many examples;
• analyzing and extracting precursor antecedents and behaviors, with all analysis completed by the SME, leading to organization theft and damage for each collected example;
• transforming antecedent precursors and behaviors leading to loss into worded items for the WBOF across all examples;
• creating data arrays with WBOF items as columns and examples used for extraction as rows and adding threat and risk outcomes for each example row;
• training pattern classifiers with examples of insider loss used for extraction whereby data arrays are created with WBOF items as columns and examples of loss used for extraction as rows and adding threat and risk outcomes for each example row;
• embedding the completed WBOF into a website accessible by the user via Internet and a browser;
• monitoring a items of a WBOF being rated by the user and when the WBOF is completed processes the resultant responses vector as input to trained pattern classifiers to produce threat and risk outcome values;
• and
• automatically embedding outcome values into a pre-written threat assessment report template in specified locations thereby completing the threat report which is forwarded as an attachment to the user's email address the SME analyzes all extracted antecedent precursors and behaviors and classifies into cohesive categories by similarity with categories formed into a hierarchy whereby top-level themes with sub themes fitting a specific top-level them are nested under the corresponding top-level,
• theme wherein the SME then finalizes top-level category themes into WBOF screening items and sub themes as detailed clarifying items under each screening item, words each theme into assessment item format, and adds organizational background items to finalize the WBOF for use and embeds the finished assessment form within the specific WBOF website.