How do we effectively monitor for Insider Threats in a hybrid work environment?

All answers to this question.

Don't forget about the "offboarding" process. Most insider data theft happens in the last 30 days of employment. Tighten up those access controls immediately.

   Answered 2024-05-21 by Nancy Young

• Absolutely, Nancy. Revoking access the moment a resignation is handed in is a standard best practice that prevents so many "parting gift" data thefts.

     Commented 2024-05-22 by Richard Anderson

The key is focusing on "anomalies" rather than "surveillance." User and Entity Behavior Analytics (UEBA) tools are great because they establish a baseline of normal activity for each role. If a marketing person suddenly starts accessing sensitive HR files or downloads 5GB of data at 3 AM on a Saturday, the system flags it. It’s not about reading their private chats; it's about monitoring technical patterns. Transparency is also vital—tell your employees that these systems are in place to protect the company from external breaches and accidental slips, which builds a culture of shared responsibility.

   Answered 2024-05-23 by Elizabeth Harris

Are you looking more for Endpoint Detection and Response (EDR) capabilities, or are you focused on Data Loss Prevention (DLP) at the network level?

   Answered 2024-05-26 by Thomas Clark

• Thomas, in a hybrid setup, network-level DLP is less effective because people work off-network. You really need an endpoint-centric approach. Modern EDR can track file movements even when the VPN is off. The goal should be to look for "indicators of intent," such as someone disabling security software or taking screenshots of sensitive databases. If you combine EDR with a strong "Security Culture" program, you catch the negligent stuff through training and the malicious stuff through tech.

     Commented 2024-05-29 by Matthew Lewis