Protecting resources from insider threats requires a sustained and coordinated effort from the enterprise. Depending on the organization, this may require the participation of multiple groups, including the security team, HR team, and various business units. However, while an insider security program does require focus, it does not have to be complicated._‍

How to Build Your Insider Threat Policies

In order to detect insider threats and protect internal assets, we first need to know what we are looking for and to establish the rules for how sensitive data should be handled. It is important to remember that our insider threat program should be able to detect and prevent malicious insiders as well as insider threats from end-user accidents or negligence.

When developing policies, organizations should first identify the data that needs to be protected. Any data that would harm an organization if exposed is a potential target of an insider threat. This often involves the company’s intellectual property, private plans, customer data, regulatory data, source code, and more. As such, a strong insider threat program should be able to include a wide range of data types and data sources.

Next, policies should define how each data type should be accessed and used. What users or systems should be allowed to access data? How will that access be controlled? And when it comes to insider threats, one of the most important aspects is to define what users are able to do with data after it is initially accessed. How will users be able to collaborate on data? What methods can be used to safely share data and with whom? This can include defining the appropriate applications, users, and teams that need to use a particular type of data asset.

How to Find Your Insider Risk

One of the best ways to prevent an insider threat is to proactively identify and mitigate insider risks. Data and user monitoring tools can be critical in this phase by revealing how insiders use data in real-world workflows. This can also provide insight into the long-term flow and spreading of data. This can reveal important risk factors such as:

• What users routinely need to work with large amounts of sensitive data?
• What are the normal business workflows that need to be supported?
• What users or groups will need to use a particular type of data?
• What happens to data after it is accessed?
• What users or applications contain copies of the data?

This level of visibility can reveal areas of unnecessary risk and can help the organization define better rules to prevent the oversharing or misuse of sensitive data.

{{ promo }}

Know the Indicators of Insider Threats

There are a variety of things that an organization can look for to identify an insider threat. One of the simplest approaches is to look for unusual behavior from an end user. This could include a user trying to access systems or resources outside their normal work role, accessing data at unusual times, or in abnormally high volume.

However, insider threats will not always be so obvious. A malicious insider could slowly accrue data over time during normal business hours. Such a user could also take steps to evade detection. As a result, organizations should also look for potentially evasive behaviors such as saving data to a compressed ZIP file, encrypting sensitive information, or attempting to change the extension of a file.

However, the most important indicator of an insider threat will be any violation of the organization’s data policy. The behavior of an accidental insider threat will likely not look suspicious at all and will blend in with normal user behavior. This means that organizations will need to be able to monitor the flow of data in real-time in order to identify common mistakes such as uploading sensitive data to a user’s personal Dropbox account instead of the corporate account.

How to Prevent Insider Threats

Actively preventing insider threats can often be a challenge. Many insider threat tools are deployed out of band, which prevents them from blocking an insider event in real time. Additionally, a suspicious user action may require further investigation to confirm the threat before an organization is willing to take action.

As such, organizations should seek out insider threat tools that allow for in-line enforcement and can maintain a consistent context of what data is sensitive. By consistently keeping track of sensitive assets, an organization can confidently take enforcement actions whenever information is about to be taken out of the enterprise.

How to Train Your Users

Users naturally play one of the most important roles when it comes to preventing insider threats. According to multiple studies, user mistakes and negligence account for between 63% and 78% of all insider threats. As such, it is critical for all insiders to be trained in terms of how sensitive data is to be handled and protected within the organization.

Ideally, organizations should complement regular user training with real-time monitoring and enforcement. For example, instead of simply blocking a user who is making a mistake, an insider threat solution can alert the user, explain the policy, and redirect to a safer alternative. This has the advantage of reinforcing better security habits in the context of a user’s natural workflow while also preventing mistakes that a user can make when distracted or in a hurry.