Detect Anomalous Activity Ahead of a Data Breach With Heuristics

No one knows your business better than you. You know when it looks normal or when it looks strange. If you don’t have an office in Shanghai, then why are there multiple login attempts from that location? If a financial analyst has never sent a file larger than 10MB, then why is he suddenly transferring 5GB zipped files to an unknown recipient? Any activity that doesn’t fit normal, everyday workflows likely indicates a potential breach or attack. You must develop heuristics to detect this anomalous activity and build a holistic, proactive defense that spans the entire third-party workflow threat surface.

Third-party workflow threats have a common theme: a user is the actor, and a file is the agent. Complete protection requires a defense that spans the full breadth of the associated threat surface: the collective paths of all files entering and exiting your organization. A comprehensive defense entails securing, monitoring, and managing all third-party workflows, including secure email, SFTP, and secure file sharing, among others.

In my previous post, I explained the importance of bringing an organization’s entire security infrastructure to bear to secure your third-party workflows. In this post, I’ll discuss the importance of developing and applying heuristics in order to detect anomalous activity along your workflows.

Take a Holistic Approach to External Threat Prevention

CISOs cannot cut corners when protecting sensitive information against third-party workflow threats. They must instead create and maintain a comprehensive and well-rounded security infrastructure. Only a holistic defense that spans the entire threat surface provides complete protection against third-party workflow threats. Every third-party communication – email, MFT, SFTP, chat, and others – must be routed through a secure conduit that extends across the entire file transfer path. By locking down the entire path, you gain the ability to channel every file that enters or exits the organization through best-in-class security solutions, including SSO, LDAP, AV, ATP, DLP, and SIEM. Also, a single conduit for all your third-party communications lets you see and protect the sensitive information you share with the outside world. Otherwise, you cannot protect what you cannot see.

Establish Benchmarks to Detect Anomalies

CISOs move from a reactive to a proactive defense once they have total control of the third-party workflow threat surface. A CISO Dashboard lets CISOs see and trace every file movement: upload, download, edit, send, receive, and more. CISOs utilize this granularity to create a tapestry of how the business interacts with the outside world. With this treasure trove of data, CISOs develop benchmarks of normal business activity and apply heuristics to detect anomalies. Why is the new financial analyst sharing a quarterly statement prior to the earnings press release? Why is someone in Engineering trying to access folders created by an HR director? CISOs with a thorough understanding of the business know this is unusual behavior. As a result, they can automatically respond to this anomalous activity before it becomes a threat, providing the ultimate defense of an organization’s most sensitive content.

Now that you have your benchmarks in place for detecting and stopping anomalous activity, how do you help prevent breaches and malicious attacks from happening in the first place? In my final post in this series, I’ll discuss using automation to help stop threats before any lasting damage is done.

To learn more about building a holistic defense of the third-party workflow threat surface, schedule a custom demo of Kiteworks today.

Additional Resources

• GlossaryRisk Management Security
• Blog PostWhat Is an Audit Log for Compliance? [Includes Solutions]
• Blog PostHIPAA Breach Notification Rule
• Blog PostHIPAA Security Rule Requirements
• GlossaryRisk Management Cybersecurity