How hybrid analytics can mitigate insider threats
Connecting state and local government leaders
Because no single approach can detect every threat, hybrid analytics can help IT managers uncover hidden, suspicious activities and see the bigger picture.
Insider threats pose a problem for any government agency that allows employees, business partners or contractors to access their highly sensitive information. No matter how extensive the vetting process when hiring individuals or forming working relationships, the possibility for an internal compromise – whether intentional or accidental – always is present.
According to estimates, once an insider threat is detected, it takes on average 17 days to investigate the incident using traditional tools and processes. By implementing a proactive threat detection program powered by hybrid analytics, IT managers can stop these threats from occurring, eliminating the need to react to them later.
There is no perfect analytic solution that can detect every threat that exists. However, by combining robust data management capabilities with a hybrid analytical approach within an automated environment, government agencies can keep ahead of their adversaries.
How it works
Every successful threat detection program first requires standard, normalized, portable data. An automated process can access and integrate all types of data, fuse it together and enrich the content so it is in a form ready for analysis. Once an automated solution is in place, a blend of the following four processes will create a hybrid analytical approach that can identify high-risk patterns of behavior and activity.
Business rules. Testing all behaviors and activities against a predefined set of algorithms or business rules can detect known types of risk behaviors based on specific patterns of activity. Usually simple things, such as multiple unsuccessful login attempts, can be detected through this process.
Anomaly detection. Setting a baseline for individual and group behaviors and patterns of activity lets IT managers determine what is normal and abnormal. Anomaly detection is considered to be a rules-based approach and can generate false positives if an employee’s behavior changes significantly. For example, an employee may be flagged as a risk because he has been downloading information late at night. But anomaly detection doesn’t consider the fact that he received a promotion and now works the night shift.
Predictive modeling. History often repeats itself. Using historical data to predict future behavior is very useful in prioritizing risk and determining the probability that an insider threat may occur. Predictive modeling can look at an individual’s past actions and indicate the likelihood that he may be engaging in potentially harmful behavior.
Social network analysis. By calculating statistical significance between connections, social network analysis can reveal relationships among people, activities and assets that may not be evident. Also called link analysis, this method generates alerts that are automatically scored based on their risk. IT managers can drill down into each threat to examine the supporting details and determine why this particular alert was triggered.
Benefits of hybrid analytics
Combining proven threat detection technologies with informed behavioral analytics can help agencies proactively detect and address threats before losses occur through:
- Automated processes – Automated data integration and analytic processing is easy to deploy in everyday operations. Employees can do more with less while increasing productivity and reducing response time.
- Rich analytics – A hybrid approach can provide a more holistic view of behavioral and network data and expose insights that are buried deep in the data.
- Prioritized alerts – The time to discovery is faster and the most important issues and probable offenders can be focused on first.
- Intelligent, self-learning model – Analytic threat detection helps to more accurately identify threats before they happen.
Security breaches are a multi-faceted problem that cannot be solved through a one-dimensional solution. Government agencies can take a proactive approach by implementing a hybrid solution that combines traditional detection methods and investigative methodologies with behavioral analysis, enabling complete and continuous monitoring. This powerful solution will not stop all insider threats, but by adopting this approach, agencies can significantly reduce the risks.
NEXT STORY: Why so slow to move off SHA-1?