12 Keys to Effective Insider Risk Management

Unfortunately, this old problem is getting considerably worse. The shift to remote work has coincided with a spike in the loss of data. Virtually every personal and business application makes it easy to share data by default. Employees are leaving organizations at a higher rate, creating more chances for users to take data to rival companies. And the rise of leak sites and double extortion techniques means that virtually any sensitive enterprise data can be monetized either by malicious insiders and ransomware actors. Long story short — most data is in play when it comes to risk, and there are countless ways and reasons for that data to be leaked.

The traditional methods used to manage insider risk simply aren’t up to the task. On the one hand, Data Loss Prevention (DLP) technologies have the potential to block data from being exfiltrated, but only apply to a few types of data and are notoriously complex and error prone. A wide variety of behavioral analysis tools can identify risky or anomalous actions, but are rarely conclusive, don’t enforce in real-time, and typically don’t know the business value of the data itself.

Organizations need a new set of capabilities in order for their insider risk management programs to truly be effective. The program must be able to apply to any type of data or asset that is valuable to the business, not just the few types of data that are easy to classify. The view of risk must understand both the value of the data itself and all the actions surrounding that data. And ultimately, organizations must be able to take actions that can mitigate their risk. This could include proactive measures to find and reduce the risky or unnecessary spread of data as well as the real-time ability to prevent data from being exfiltrated.

These are just some of the topics covered in our paper, 12 Must-Have Requirements for Modern Insider Risk Management. In this paper, we dive into a dozen key capabilities that are essential for effectively managing insider risk. Specifically, we show why each capability is important to the business, some of the potential challenges, and how new technologies such as Data Detection and Response (DDR) can close the gaps.