Verizon, which sits between the sources and victims of cybercrime daily, presented countermeasures, condensed here, to help reduce risks and enhance incident response efforts:

Integrate a comprehensive insider threat program with other existing strategies such as a risk management framework, human resources management and intellectual property management to strengthen efficiency, cohesion and timeliness in addressing insider threats.
Refine threat hunting capabilities such as threat intelligence, dark web monitoring, behavioral analysis and endpoint detection and response solutions to search, monitor, detect and investigate suspicious user and account activities, inside and outside the enterprise.
Perform vulnerability scanning and penetration testing to identify gaps within a security strategy, including potential ways insider threats could maneuver within the enterprise environment.
Implement personnel security measures including human resource controls (such as employee exit processes). Also, security access principles and awareness training can mitigate incidents associated with unauthorized access to enterprise systems.
Employ physical methods for access such as identity badges, security doors and guards to limit physical access as well as digital access methods including card swipes, motion detectors and cameras.
Implement network perimeter and segment security solutions, such as firewalls, intrusions detection/prevention systems, gateway devices and data loss prevention solutions to detect, collect and analyze suspicious traffic potentially associated with insider threat activities.
Employ established endpoint security solutions, such as critical asset inventories, removable media policies, device encryption and file integrity monitoring to deter, monitor, track, collect and analyze user related activity.
Apply data ownership, classification and protection, as well as data disposal measures in order to manage the data lifecycle and maintain confidentiality, integrity and availability with insider threats in mind.
Employ identity, access and authentication management measures to manage limit and protect access into the enterprise environment.
Establishing an incident management process to include an insider threat playbook with trained and capable incident handlers.
Have a retained incident-response resource available to conduct a full-spectrum of deep-dive investigations.

Instant Insights /

Insiders Causing 20% of Cybersecurity Incidents: Verizon

Related Stories

Recommended For You