Control insider threats with data loss prevention and user activity monitoring

Insider threats have long been a concern to government agencies that deal with sensitive citizen information or even classified data. In an era of remote and hybrid work, that worry has only increased, as more workers access more data from more devices in more places.

But insider threats exist on a continuum with external malicious activity. Even the most engaged and dedicated employee can fall prey to a spear-phishing exploit that leaks credentials and opens agency systems to unauthorized access.

So, whether the risk comes from an internal bad actor or an attacker that merely looks like an authorized user, agencies need the cybersecurity tools to protect their networks, data and users. Just as important, they must shift “left of boom” – stopping suspicious activity before it turns into a data breach.

Raised risks, limited insights

Hybrid work has introduced two challenges in protecting against insider threats. First, remote employees are more likely to use personal devices to access and share agency data. Even if agency-provided endpoints are fully protected, it’s difficult to extend those protections to personal devices.

Second, remote workers sometimes feel cut off from the teams they used to see every day. They can become less engaged and less loyal to the enterprise. That’s one reason organizations are seeing so many employees fluidly come and go from jobs. As workers leave, there’s risk that some could take sensitive data with them.

One protection against insider threats is data loss prevention. DLP involves a range of technologies, including basics like end point and edge protection solutions. But while DLP can log and even block suspicious behavior at various control points, it can also deliver false positives that distract from actual threats and erode user productivity.

Let’s say a team member attempts to transfer data from an agency database to their cloud storage. DLP might identify that a transfer has been attempted and even prevent the transfer from occurring. But it doesn’t answer the question of why the employee took that action and whether it represents a malicious or inadvertent breach. And if the technology presents more questions than answers, it’s not the right technology.

UAM for insights and control

The solution is to augment DLP with user activity monitoring. Effective UAM reveals the user’s intent. For example, it could uncover that the user transferred data because she needed to download large files to get her job done, but agency technology prevented that. Rather than representing a data breach, it points to technology limitations that are slowing employee productivity.

A UAM solution should also consider behavioral analytics as part of the insider risk journey. Behavior analytics creates a dynamic risk score for every user and establishes a baseline of a user’s typical behavior for identifying anomalies. Risk scores are updated in real time as behavior changes, with corresponding risk levels gradually increasing and decreasing over time. If a user’s baseline risk level is “low,” their granular risk score and corresponding level might increase to “high” if they transfer data to personal cloud storage. Once it’s been determined that the behavior wasn’t malicious, the risk score will immediately decline, with the risk level gradually decreasing to a normal baseline.

The same insider risk approach can be extended to cyber protections like a cloud access security broker for unmanaged devices. Utilizing CASB as another data source and potential control point gives IT managers the same visibility and risk adaptive control as on agency-issued endpoints while not impacting user productivity and minimizing any potential data privacy concerns. 

Shifting left of privacy concerns

As agencies implement UAM, they should keep in mind how employees might respond to technology that monitors their behavior. Effective UAM will keep personal information private, limit access to authorized roles and automate manual touchpoints to remove human bias.

Consider creating a policy control board that involves stakeholders from IT, HR, legal, ethics, security and compliance departments. Start with mapping DLP and UAM policies to the employee acceptable use policy workers sign when they join the agency. And make sure team members understand the benefits of DLP and UAM: The better protected the agency data, the better protected users’ personal identifiable information. 

Privacy isn’t the only strategy that can be influenced by DLP and UAM. Once IT managers better understand why employees are engaging in certain behaviors, they can take actions to improve agency operations. For instance, they might discover they need to provide better training on how to use agency technology or configure technology differently to optimize productivity.

Finally, DLP and UAM with behavioral analytics can support zero trust cybersecurity. By never trusting, always verifying, and by dynamically adjusting risk scores based on user activity, agencies gain more holistic control over cyber protections against not just insider threats but also external malicious actors. Ultimately, they can shift left of boom – identifying, understanding and stopping dangerous behavior before it results in a data breach.