Become an Insider Risk Management Ninja

Patrick_David · ‎Apr 19 2022

Become an Insider Risk Management Ninja

**Insider Risk Management is a solution in Microsoft Purview. Some assets and past recordings may refer to it as Insider Risk Management in Microsoft 365 or in Microsoft Compliance; these all refer to the same solution. **

** Updated July 2023 **

In this Ninja page, we share the top resources for Insider Risk Management users to become more proficient with the Microsoft Purview Insider Risk Management solution.

We are very excited and pleased to announce this edition of the Ninja Training Series. There are several videos and resources available, and the overall purpose of the Insider Risk Management Ninja training is to provide the relevant resources to get started and become more proficient in this area.

After each section, there will be a knowledge check based on the training material you’ve just finished! Since there’s a lot of content, the goal of these knowledge checks is to help you determine if you were able to get a few of the major key takeaways.

Lastly, this training will be updated on a quarterly basis to ensure you all have the latest and greatest material! We are continuously delivering product updates and thus you should check both the public roadmap and message center posts to stay up to date.

Let us know what you think below in the comments!

Latest Insider Risk blog is at: https://aka.ms/insiderriskblog

All Insider Risk Management Blogs

Legend:

Product videos	Webcast recordings	Tech Community
Docs on Microsoft	Blogs on Microsoft	GitHub
New items	Interactive guides	Learning path
⤴ External Sites	Podcast

Why do I need Insider Risk Management?

We are operating in the most sophisticated threat landscape ever seen and coupled with the latest great disruption—hybrid work—security is more challenging than ever. Protecting your organization from external threats is only one piece of the puzzle. You also must protect your organization from the inside out, another facet of “assume breach” in your Zero Trust approach. Insider risks can be malicious or inadvertent, but they all impact one of your organization’s most important assets: your data. Based on recent surveys we know that more than 60% of insider threat incidents were the result of employee carelessness. In the 2022 Cost of Insider Threats: Global Report, the Ponemon Institute found that the average cost of activities to resolve an insider incident was $15.4M USD and it took an average of 85 days to contain an incident. A 2021 Verizon data breach investigation report showed that >20% of security breaches are due to internal actors. Research from Carnegie Mellon University’s CyLab in 2021, with support from Microsoft, found that a majority of surveyed organizations had experienced over five malicious insider threat incidents in the last year (69 percent of respondents), and over 10 inadvertent or data misuse incidents (58 percent of respondents). Gartner® predicts, “By 2025, insider risk will cause 50% of organizations to adopt formal programs to manage it, up from 10% today.”**

Ready for the Why do I need Insider Risk Management knowledge check?

Overview

Insider risk management helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization. Risk analysts and investigators in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards.

Ready for the Overview knowledge check?

Getting Started

Use insider risk management policies to identify risky activities and its management tools to act on risk alerts in your organization. There are steps to help you get started with everything from permissions, analytics, easy policy creation, and managing your policies. Once potential risk is identified an investigator can review the details of an alert to make a decision based on the organizational policies. We hear from customers how valuable context is during a security investigation. With forensic evidence, an opt-in add-in to Insider Risk Management, security teams can get visual insights into potentially risky user actions that might lead to a data security incident, all while protecting user privacy. With customizable event triggers and built-in user privacy protection controls, the visual capturing capabilities from forensic evidence help security teams better investigate, understand and respond to potential security data incidents like unauthorized data exfiltration of sensitive data. The benefit to customers is having more context available to support security investigations, which can drive accuracy and timely resolution as well as help in determining whether security and compliance incidents stem from willful or inadvertent actions, a stolen device, malware infections or other security related risks. We know that protecting the privacy of users that have policy matches is important and can help promote objectivity in data investigation and analysis reviews for insider risk alerts which is why we offer pseudonymization which is on by default.

Ready for the Getting started knowledge check?

Adaptive Protection

Adaptive Protection in Microsoft Purview uses machine learning to identify and mitigate the most critical risks with the most effective data loss prevention (DLP) protection controls dynamically, saving security teams valuable time while ensuring better data security. Adaptive Protection helps increase risk mitigation by extending and managing preventative options associated with detected risky action to the capabilities provided by DLP policies.

Adaptive Protection helps mitigate these potential risks by using:

Context-aware detection. Helps identify the most critical risks with ML-driven analysis of both content and user activities.
Dynamic controls. Helps enforce effective controls on high-risk users while others maintain productivity.
Automated mitigation. Helps to minimize the impact of potential data security incidents and reduce admin overhead.

Adaptive Protection dynamically assigns appropriate DLP policies to users based on the risk levels defined and analyzed by the machine learning models in insider risk management. With this new capability, static DLP policies become adaptive based on user context, ensuring that the most effective policy, such as blocking data sharing, is applied only to high-risk users while low-risk users can maintain productivity. The policy controls constantly adjust, so when a user’s risk level changes, an appropriate policy is dynamically applied to match the new risk level.

Ready for the Adaptive Protection knowledge check?

Connectors

While Insider Risk Management can get several first-party signals without having to configure or set up additional agents. We can also get additional insights from Endpoints, Microsoft Defender for Cloud Apps, and Microsoft Defender for endpoints. We can bring in additional insights from your HR system, physical badging platform, and Electronic Health Records (EHR) system to improve the signal quality and increase the number of signals we are able to pull in. We recently announced the ability to import third-party insider risk detections with a connector. With the new Power Automate guidance for the HR data connector and the 3rd party connector we are making it easier to automate some of this process.

Ready for the Connectors knowledge check?

Integrating with other tools

Insider Risk Management can ingrate with other tools such as Microsoft Communication Compliance, which can identify users who are sending inappropriate messages over work channels, such as threatening or harassing messages, could potentially become a risk to your organization. Leveraging these risk signals in Insider Risk Management policies, security teams can detect risky actions that may lead to a security incident. In addition to Communication Compliance, security incident and event management (SIEM) integration with Insider Risk Management leverages the Office 365 Management APIs or PowerAutomate, which can be configured to take repeatable actions as part of the remediation process. If the alert warrants further investigation, then you can escalate the policy violations seamlessly from Insider Risk Management to an eDiscovery (Premium) case for deeper legal review or action.

Ready for the Integrating with other tools knowledge check?

Fine-tuning your policies for Insider Risk Management

When you get started with Insider Risk Management you can use analytics to understand what policies you might want to create. As you build your policies you might notice that some are too noisy or you are missing activities you want to see. There are several options that can help you fine-tune the policies so you are alerted on the most actionable alerts for your organization's risk. One of the areas of focus should be on the intelligent detection signals where you can look to filter out certain file types, locations, allowed and unallowed domains, sensitive information types, trainable classifiers, keywords and much more. These will help you fine-tune policies to get activities that are most relevant to your organization. Another area we recently made changes was to priority content and priority content only scoring. These settings within a policy allow you focus on the priority content so when you get an alert you know it is based on what you define as priority.

Ready for the Fine-tuning your policies knowledge check?

Additional Resources

Microsoft 365 Roadmap: Roadmap of upcoming features and changes.
Message Center: Notifications and details of updated changes to Microsoft 365
What is new in Microsoft Purview
Tech Community – Security and Compliance: Blogs, community forums, and more
Insider Risk Management feedback portal

Once you’ve finished the training and the knowledge checks, please go to our attestation portal to generate your certificate; you'll see it in your inbox within 3-5 business.

**Gartner, Predicts 2023: Cybersecurity industry focuses on the human deal, Jan 25, 2023
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Products (50)

Special Topics (27)

Video Hub (462)

Most Active Hubs