During a recent Fortify Experts CISO Round Table, over 30 security executives shared actionable insights on minimizing exposure to insider threats and data loss, leveraging processes and cutting-edge technologies, and aligning security initiatives with business objectives.
1. Insider Threats and Data Loss
The forum began by tackling the challenges of insider threats and data loss prevention (DLP). Participants agreed that preventing insider threats entirely is unrealistic. Instead, organizations must focus on detecting anomalies and responding effectively. The discussion revealed a spectrum of insider threats, from malicious intent to negligence and accidental actions.
Key Concerns:
- Detection vs. Prevention: One CISO remarked, “You can monitor all you want, but at some point, these people are authorized to have access. Without access, they can’t do their jobs, so it’s a catch-22.”
- Negligence and Mistakes: Another leader emphasized that many insider incidents are not malicious but stem from errors, stating, “A significant portion of insider threats are accidental. Misconfigurations and human error often trigger alerts, and differentiating these from malicious activity is a challenge.”
Best Practices Highlighted:
- User Behavior Analytics: Brent shared how his organization uses machine learning to baseline normal user behavior.
He explained, “We assign a score based on activity. For example, if a user is moving gigabytes of data at 2 a.m., that’s not normal. It raises a flag for investigation.”
- Access Restrictions and Encryption: Several participants discussed deploying encryption at endpoints.
One CISO shared, “As employees move data, we encrypt it with private keys tied to their accounts. If they leave, the data is inaccessible.”
2. Generative AI Risks
Generative AI tools like ChatGPT and other LLMs emerged as a pressing concern. Leaders expressed unease about how these tools aggregate vast amounts of sensitive data, making it easier for a single insider to exfiltrate valuable information.
The New Threat Landscape:
- From Collaboration to Consolidation: Traditionally, large-scale insider threats required collaboration among multiple bad actors.
One leader noted that “With AI, now, a single person can ask the right questions to retrieve 50 years of proprietary information in minutes.”
- Challenges with Monitoring: He also described efforts to monitor data flows to and from AI tools, stating,
“We’ve deployed shims in browsers to track interactions with AI platforms, but the effectiveness is limited. These vendors change their APIs regularly, so it’s a cat-and-mouse game.”
Potential Mitigations:
- Internal AI Models: One organization restricted AI use to internal platforms with strict data controls.
He added, “We’ve offered funding for teams to adopt our internal AI. It’s been an effective carrot to ensure compliance.”
- Tagging and Data Loss Prevention: Participants agreed that sensitive data must be tagged and monitored when it interacts with AI tools.
One leader noted, “Our current tagging efforts would barely get a passing grade.”
Check out this affordable GenAI Collaboration and Security Platform to check out is www.graice.com
For a free trial, use Promo Code: Fortify2024
3. Security Technology and Strategy
The forum underscored the need for thoughtful technology deployment and strategy alignment with business goals. Participants shared practical steps to mature security programs.
Recommended Approaches
- Start Small with Telemetry: A leader suggested deploying endpoint monitoring tools in “learn mode,” explaining:
“We used Proofpoint to gather telemetry and understand our baseline before enforcing policies. It helped us build a narrative supported by data.”
- DLP and Access Management: Organizations cited Microsoft Purview and similar tools as essential for controlling data flow.
One participant shared, “We’re setting up a bucket for CUI data and using DLP rules to enforce its usage. It’s a work in progress, but critical for compliance.”
- IAM Integration Challenges: From mergers to legacy systems, IAM was a recurring challenge.
One leader noted, “We struggle with integrating IAM during acquisitions. It’s a battle to align immature and mature processes.”
Insights from the Group:
- One leader emphasized the need for tools to manage onboarding and offboarding processes seamlessly, explaining:
“We’re using Workday as the source of truth, but HR delays create gaps that technology can’t fully solve.”
Another leader added, “The goal of IAM is to lay the foundation for Zero Trust. Achieving zero trust is impossible without a strong IAM strategy.”
4. Addressing Executive Resistance
Executives often resist security measures that disrupt their workflows, creating tension for security teams. Leaders shared strategies for navigating this sensitive issue.
- Executive Accountability: A common pain point was executives’ resistance to adhering to the same insider threat criteria that employees were subject to.
One leader stated, “We treat everyone the same. It works well because it removes accusations of bias and simplifies enforcement.”
- Building Trust Through Transparency: One CISO described how treating executives like any other employee built credibility:
“We don’t create exceptions. Even our CEO goes through the same approval processes. It’s easier to defend policies when everyone is held to the same standard.”
- Metrics as a Communication Tool: The forum stressed the importance of using metrics to gain executive buy-in.
“Metrics help you tell a story,” one participant explained. Another added, “You need to frame metrics in terms of business impact. For example, show how a delayed patch could result in a breach that costs millions.”
5. Recommendations for Building a Mature Insider Threat Program
To conclude, participants shared actionable advice for organizations starting their journey toward a robust insider threat program.
Step-by-Step Recommendations:
- Deploy Endpoint Monitoring: Start with basic telemetry collection to understand user behaviors.
- Analyze and Prioritize: Use the collected data to identify high-risk behaviors and refine strategies.
- Secure Funding Through Storytelling: Present data-driven narratives to executives to secure buy-in and budget.
- Incremental Wins: Focus on small, impactful changes like streamlining IAM or automating account deprovisioning.
Final Thoughts:
- One participant summarized the discussion by saying, “This isn’t about eliminating all risk. It’s about layering defenses so no single failure can compromise your organization.”
- Another added, “The goal is resilience. You’ll face insider threats, but with the right tools and processes, you can respond quickly and minimize impact.”
The discussion underscored the complexity of modern cybersecurity challenges and the need for continuous adaptation. Leaders were candid about the gaps in existing solutions but optimistic about the potential for collaboration and innovation to bridge them.
About Tim Howard
Tim Howard is the founder of 5 technology firms, including Fortify Experts, which helps companies create higher-performing teams through:
- People (Executive Search and vCISO/Advisory consulting),
- Process (NIST-based security assessments and Leadership Coaching),
- Technology (Simplifying Security Solutions), check out Fortified Desk,
How I can help you:
- Join over 30,000 People Getting Free Security Leadership Improvement Advice – Follow me on LinkedIn. www.linkedin.com/in/timhoward
- If you want to hire a great security leader, download our free ebook on How to Hire a Great CISO.
- If you want to quickly assess your Cybersecurity Maturity Level or Need a Strategic Improvement Roadmap, Contact me.
- If you are looking to simplify cybersecurity, check out Fortified Desk, the Zero-Client secure, instantly deployable, BYOD workspace.
- Come be a part of the discussion in our Monthly CISO Forums.