Credit: Dreamstime
Data recovery and cyber security provider Code42 has added custom insider risk indicators (IRIs) to Incyder, its SaaS-based data protection software designed to allow security teams to detect and respond to information exposure and exfiltration from corporate computers, cloud-based systems, and email programs.
The new IRI capability is available immediately as part of Incyder at no extra cost to users, and aimed at enabling security teams to customise their insider risk alerts based on needs specific to their business and industry, allowing prioritisation of sensitive events.
“While there is often heightened attention and numerous protections placed on highly-regulated data, it has been historically difficult for businesses to protect their intellectual property and strategic data from insider events,” the company said in a news release. “With the new IRIs, Code42 Incydr data protection allows teams to prioritise and focus their efforts on their most important files.”
IRI allows domain specific customisation
As intellectual property and business-specific data differ across business sectors, Code42 Incydr’s new IRI capability will enable security teams to define and customise alerts for specific and relevant file types. This can be done by adjusting the risk settings to add more weight to certain file names, types, sources, and destinations.
“If insider risk management is important to an organisation, then customisation and tailoring to the environment is much better than not having that available,” said Michael Sampson, an analyst at Osterman Research. “Minimising false positives and false negatives in such environments is critical to not overwhelming analysts.”
A manufacturing company, for instance, can heavily weight their CAD drawings, just as technology companies can prioritise data being moved from high-value sources, such as Git repositories, according to Code42.
In addition to custom IRIs, Code42 Incydr data protection allows security teams to adjust their response to alerts, including by blocking unacceptable user activity.
Sampson said that different types of insider threats may require different responses.
“There’s the accidental one, which is best handled by questioning the employee to confirm if they are doing what they intend to do,” Sampson said. “Then there’s the malicious one, where insiders seek to steal something that isn’t theirs to take, e.g., IP, confidential data. In that case, it should be quietly intercepted, blocked, and escalated for mitigation, e.g., interaction with the employee, or greater monitoring of what they are doing.”
