Walter is a longtime employee as a cleared contractor. Which of the following events might indicate a potential to be an insider threat? Select all that apply.

A. Walter has recently taken up a few expensive hobbies, including fixing classic cars.

B. Walter no longer participates in office conversations and activities like he used to.

C. Walter recently requested access to a colleague’s credentials to a networked information system to perform a task.

D. Walter recently got into a shouting match with a colleague in the parking lot.

In the context of identifying potential insider threats, it's important to look for changes in behavior or actions that may suggest someone is a risk to an organization. While not all changes in behavior are indicative of malicious intent, there are specific signs that can raise concern:

Walter has recently taken up a few expensive hobbies, including fixing classic cars.
- This on its own may not necessarily indicate an insider threat. However, if Walter's spending patterns have suddenly changed and are inconsistent with his income, it could be a potential warning sign, especially if there is no clear explanation for the source of the funds.
Walter no longer participates in office conversations and activities like he used to.
- Withdrawing from normal social and professional interactions can be a red flag. It may suggest that Walter is experiencing stress, dissatisfaction, or other changes in his circumstances that could make him more vulnerable to being exploited for insider activities.
Walter recently requested access to a colleague’s credentials to a networked information system to perform a task.
- Unauthorized attempts to gain access to information systems or credentials are significant red flags. This behavior can directly correlate with insider threats as it may indicate an intention to access or manipulate sensitive information improperly.
Walter recently got into a shouting match with a colleague in the parking lot.
- This behavior indicates conflict or potential personal issues but is less directly linked to insider threat activities unless it is part of a pattern of escalating behaviors or conflicts.

Based on the options provided, choices (b) "Walter no longer participates in office conversations and activities like he used to" and (c) "Walter recently requested access to a colleague’s credentials to a networked information system to perform a task" are more likely to indicate potential insider threat activity. These behaviors suggest withdrawal from normal social interactions and an attempt to access sensitive information or systems improperly.

It is crucial for organizations to have mechanisms in place to monitor for these types of behaviors and address them through proper channels, such as security assessments, counseling, or intervention, to mitigate risks effectively.