Managing the Insider Threat: Why Visibility is Critical

No ratings

Presented at InfoSecurityEurope 2019 by

Lee Duff

Ponemon research shows that the average time to spot and contain an insider threat is 72 days - only 16% of incidents are identified and contained within 30 days. This delay can have big ramifications for the organisation, including cost, sensitive data loss and reputational damage. Only with full visibility into all employee or third-party activity across the network can even the earliest indicators of an insider threat be detected, investigated and user intent verified. Real-time alerts play a vital role in detecting unauthorised behaviour, like policy violations or data exfiltration attempts. Sorting the signal from the noise, which can lead to alert fatigue for security teams, however, is key. It can be done.In this session, you will: Discover how the key components of full visibility – user activity, data activity, and behaviour analytics – work together to stop insider threats Learn how to configure alerts that work, from rule structure and syntax to logic and guides How to use the full activity intelligence gathered to educate users in better data security