Human error led cybersecurity issues are the biggest threat contributors to organisations. The transition to hybrid work, the increased Joiner – Leaver activities has created more opportunities for data loss through an insider activities than ever before.
Do you consider Insider risk management a key activity to manage data / value loss?
-
Yes, We are actively driving an Insider risk program.
-
No, we rely on our employees to do the right thing.
Whether you are actively driving an insider risk program or not yet considering as an area of investment, your information and organisation value is already on the move with increased collaboration with transition to Modern workplace and better access to enterprise information across devices, and locations.
Users in the modern workplace have access to create, manage, and share data across a broad spectrum of platforms and services. In most cases, organizations have limited resources and tools to identify and mitigate organization-wide risks while also meeting user privacy standards. At Infotechtion, we are actively working with organisations to develop business case and strategy for proactively leveraging the User and Information related signals collected in your IT applications and assess your risks to potential data loss activities.
Infotechtion offers a free (Funded by Microsoft) data led Compliance Assessment to help customers get a better understanding of their existing privacy and Insider risks.
Lessons from customers with active insider risk program provides following insights into quickly establishing your own strategy:
-
Name your insider program right: Insider risk or Insider threat? It’s important to define the correct terminology and its positioning within your organisation. Insider risk program is as much as about enabling your users and provide support to do the right thing compared to preventing malicious activities. 95% of cybersecurity issues are traced to Human error according to World Economic Forum. The business case MUST include user empowerment as a key theme instead of a ‘big brother’ watching.
-
Involve the correct Stakeholders: Identify the key stakeholder groups as part of initial business case, planning and strategy development. The following groups are pivotal and highly recommended to involve in early discussions:
-
Cybersecurity (Information Technology)
-
Legal and Compliance
-
Data Privacy Office
-
Human Resource
-
Business / Department Owners
-
Know Your Risks: This part is often complicated as many organisations transition to cloud, not all information is on a single IT platform. Surveying your employee population and identifying where on the scale of the high risk behaviour people are to build effective strategy for identifying potential risks early and apply appropriate remediation leveraging the technology and the employee education activities.
For several organisations, activating Insider risk program is a journey which involves engagement and integration with several Information management and governance improvement activities in the organisation.
While an insider risk enablement has several connections into larger Information management, governance and protection, Infotechtion approach to it provides a well tested approach to focus on key scenarios which can quickly deliver tactical solutions while establishing a strategy for effectively managing the coordination, review and resulting actions from the monitoring of scenarios considered higher on the scale of risky behaviours.
You can start your journey with a free demo of the available Insider risk workflows which can be quickly activated to show quick value.
