Manage Insider Risk in Microsoft 365 (part 1)

By Ashwin Venugopal -

 


For further details please click here


Insider Risk Management

Traditional approaches to identify insider risks like user behavior analytics, monitoring user activity, and data loss prevention always suffers from the limitations such as complex deployment scenarios, limited insights, and a lack of workload integration beyond SecOps. 

The Insider Risk Management solution in the Microsoft 365 leverages the Microsoft Graph, security services, and connectors to Human Resources (HR) systems like SAP, to obtain real-time native signals such as file activity, communication sentiment, abnormal user behaviors, and resignation date. The built-in policy templates allows you to identify and mitigate the risky activities while simultaneously balancing the employee privacy versus organization risks with privacy-by-design architecture. Finally, the end-to-end integrated workflows ensures that the right people across security, HR, legal, and compliance are involved to quickly investigate and take action once a risk has been identified. 

Risk Pain Points in the Modern Workplace

Managing and minimizing risks in your organization generally starts with understanding the types of the risks found in the modern workplace. Some examples of the internal risks from the employees includes:



  • Intellectual Property (IP) theft
  • Espionage
  • Leaks of sensitive business assets
  • Confidentiality violations
  • Sabotage 
  • Fraud
  • Insider trading
  • Code-of-conduct violations
  • Regulatory compliance violations

Insider risks vary by industry. In healthcare, internal fraud is the most frequently cited type of risk, while sabotage represents the greatest risk to the IT businesses.

Common Insider Risk Scenarios

The insider risk management solution in Microsoft 365 helps you to detect, investigate, and take action to mitigate internal risks in your organization in common scenarios, such as:
  • Data theft by departing employee- When employees leave an organization, either voluntarily or as the result of termination, there is often legitimate concerns that the company, customer, and employee data are at risk as the employees may either innocently assume that the particular project data isn't proprietary, or they may be tempted to take the company's data for personal gain and in violation of company policy as well as legal standards.

  • Leak of sensitive or confidential information- In the most cases, employees try their best to properly handle sensitive or confidential information but occasionally they can make mistakes and the information is accidentally shared outside your organization or in violation of your information protection policies. Sometimes the employees may intentionally leak or share sensitive and confidential information with malicious intent as well as for potential personal gain.

  • Actions and behaviors that violate corporate policies- Employee-to-employee communications are often a source of inadvertent or malicious violations of the corporate policies that can include offensive language, threats, and cyber-bullying between employees. This type of activity contributes to a hostile work environment and can result in the legal actions against both the employees and the larger organization.     

Insider Risk Management Workflow

Identifying and resolving the internal risk activities as well as compliance issues with the insider risk management in Microsoft 365 uses the following workflow:

  • Policies- Insider Risk Management policies determine which policies are in-scope and which types of the risk indicators are configured for alerts.

  • Alerts- Insider Risk Management alerts are automatically generated by risk indicators defined in insider risk management policies while providing the compliance analysts and investigators an all-up view of the current risk status as well as allow your organization to triage and take actions for the discovered risks.

  • Triage- Reviewers can quickly identify insider risk alerts and examine each to evaluate and triage. Alerts are resolved by opening a new case, assigning the alert to an existing case, or dismissing the alert.

  • Investigate- Cases are manually created from alerts in the situations where further action is needed to address an issue for an employee.

  • Action- After investigating the details of a case, you can easily take action by sending the employee a notice, resolving the case as benign, or escalating to a data or employee investigation. 


For further details please click here




Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more