Manage Insider Risk in Microsoft 365 (part 2)

By Ashwin Venugopal -

 


To read part 1 please click here


Assign Permissions

A global administrator will always need to assign you and other compliance officers to the Insider Risk Management or Insider Risk Management Admin role group by using the Permissions module in the Microsoft 365 compliance center and once assigned to one of these roles, you will have the ability to assign additional users to the specific role groups to manage different sets of insider risk management features.

You have the ability to choose from the following role group options when configuring insider risk management:

  • Insider Risk Management- You can use this role group to manage risk management for your organization in a single group. It contains all the insider risk management permission roles and is the easiest way to quickly get started with insider risk management as well as a good fit for organizations that do not need separate permissions defined for separate groups of the users.

  • Insider Risk Management Admin- You can use this role group initially configure insider risk management and later to segregate insider risk administrators into a defined group. The users in this role group can create, read, update, and delete insider risk management alerts, cases, as well as notice templates but cannot access the insider risk content explorer. 

  • Insider Risk Management Analysts- You can use this group to assign permissions to the users that will act as the insider risk data investigators. The users in this role group can access all the insider risk management alerts, cases, notices templates, and the Content Explorer for all the cases.  

Potential Dependencies

Two of the insider risk management templates have dependencies that must be configured for policy indicators to generate relevant activity alerts which might be optional depending on the policy you plan to configure for your organization. 

Departing employee data theft template

If you want to configure a policy using the Department employee data theft template, you'll need to configure a Microsoft 365 Human Resources (HR) data connector so that you can import user and log data from third party risk management as well as human resources platforms which helps you to alert drive alert indicators in insider risk management policies and is an important part of configuring full risk management coverage in your organization. The following requirements must be met before you can set up an HR connector:

  • A global administrator will need to consent to allow the Office 365 Import service to access data in your organization.
  • The user who creates the HR connector will need to be assigned the Mailbox Import Export role in Exchange Online. 
  • You have to have a system in place for retrieving and exporting the data from your organization's HR system as well as add it to a CSV file.   

Once all the requirements have been met, you can easily set up your HR connector.

Data leaks template

Insider Risk Management supports the DLP policies to help identify the intentional or accidental exposure of the sensitive information to the unwanted parties which help to drive the alert indicators for the sensitive information and is an important part of configuring full risk management coverage in your organization. 
Note- To reduce noise, alerts will only fire when a high volume DLP policy qualifying event is triggered. For example, an alert will fire if the policy detects 10 or more credit card numbers in an email or document, but not less. 

Creating a new insider risk policy

To create a new insider risk management policy, you can use the policy wizard in the Insider Risk Management solution present in the Microsoft 365 compliance center. You can also create a new policy briefly by stepping through the policy wizard and policy settings to configure the following items:

  • Policy template
  • Users or groups- the policy will apply to (optionally, assign higher risk scores to detected activity based on where the related content located, what sensitive info is included, and what sensitivity labels are applied). 
  • Alert indicators (Indicators need to be enabled under the Policy Settings before they can be selected when creating a policy).
  • Duration (time frame) for monitoring  



To read part 1 please click here


Comments

Post a Comment

Popular posts from this blog

Query, Visualize, & Monitor Data in Azure Sentinel

By Ashwin Venugopal -
Image
  Azure Sentinel Workbooks Several ready for use templates are provided by the Azure Sentinel that can be used to create your own workbook and then modify them as needed for Contoso. Most of the data connectors it uses to ingest data come with their own workbooks, but better insight can be obtained by simply looking into the data that is being ingested by using tables and visualizations, including bar and pie charts. You can also make your own workbook easily by using this data from the beginning instead of using the predefined templates. Workbook Page You can easily access the workbook page from the Azure Sentinel from the navigation pane which consists of the: Workbook header- You can add a new workbook and review the saved workbooks as well as templates that are available on the workbook page. Templates section- You can access existing workbook templates on the Templates tab. You can save some of the workbooks for quick access and they will appear on the My Workbooks tab.  From the
Read more

Planning for Implementing SAP Solutions on Azure (Part 2 of 5)

By Ashwin Venugopal -
Image
  To read part 1 please click  here To read part 3 please click  here To read part 4 please click  here To read part 5 please click  here Load Balancing The load balancer uses probe ports to determine as well as route the traffic to an active DBMS node, but of there's any failover then the most common SAP application architecture can automatically reconnect against the private virtual IP address without the need for the SAP application to reconfigure it, while the load balancer redirect the traffic against the private virtual IP address without any need for the SAP application to reconfigure. The loaf balancer also offers an option of DirectServerReturn which if configured, can help in directing the traffic from the DBMS VM to the SAP application layer directly to the application layer without routing through the load balancer. But, if it isn't configured, then the return traffic to the SAP application layer is routed through the load balancer. You can also use Azure Load Balan
Read more

Work with String Data Using KQL Statements

By Ashwin Venugopal -
Image
  Extract Data from Unstructured String Fields Unstructured string fields often contains the Security log data and requires parsing to extract data. There are multiple ways of pulling information from string fields in KQL and the two primary operators used are extract and parse.  Extract It gets a match for a regular expression from a text string. You can convert the extracted substring to the indicated type.  Arguments regex- A regular expression. captureGroup- A positive int constant indicating the capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, 2 or more for subsequent parenthesis.  text- A string to search. typeLiteral- An optional type literal. If provided, the extracted substring is converted to this type.  Returns If regex finds a match in text- the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral. If there's no mat
Read more