Use Supervision to monitor email, Microsoft Teams, manage risk, meet regulatory requirement and more
Monitoring digital communications is critical to mitigating conduct, reputational, and financial risks. With Microsoft 365 Supervision solution you can monitor Exchange email, Microsoft Teams chats and channels, leverage sensitive information types and use advance message filters, and utilize an integrated review process.Leveraging AI and automation to quickly identify and investigate insider risks
I spent several years in the Microsoft internal digital security and risk organization helping to develop various programs to identify insider risks, threats and code of conduct policy violations in collaboration with our human resources (HR) and legal teams. The ability to identify these risks and policy violations and then take action to minimize the negative impact is a priority for organizations worldwide. Modern workplaces offer innovative technology that employees love, empowering them to communicate, collaborate, and produce with agility. Trusting your employees is the key to creating a dynamic, inclusive workplace and increasing productivity. But, with trust also comes risk. In fact, a survey by Crowd Research Partners indicated that 90% of organizations feel vulnerable to insider risks and 53% confirmed insider risks against their organization in the previous 12 months. We know from our own experience that it’s hard to maintain trust without the right visibility, processes and control. However, the effort required to identify these risks and violations is not trivial. Think about the number of people accessing resources and communicating with each other, as well as the natural cycle of people entering and leaving the company. How do you quickly determine what is an intentional risk vs. an unintentional one at scale? And how do you achieve this level of visibility, while aligning to the cultural, legal and privacy requirements in which you operate? For example, truly malicious insiders do things such as intentionally stealing your intellectual property, turning off security controls or harassing others at work. But there are many more situations in which an insider might not even know they are causing a risk to the organization or violating your policies, like when they’re excited about something new they’re working on and send files or photos to tell others about it. Ultimately, it’s important to see the activities and communications that occurred in the context of intent, in order to take the right course of action. The only way to do this efficiently and at scale is by leveraging intelligence and machine learning, as human driven processes can’t keep up and aren’t always that accurate. Furthermore, a holistic solution to this problem requires effective collaboration across security, HR and legal, as well as a balanced approach across privacy and risk management. Today I am excited to announce two new Microsoft 365 solutions, Insider Risk Management and Communication Compliance. These solutions can help you and your organization to leverage intelligence to identify and remediate insider risks and code of conduct policy violations, while meeting regulatory requirements. Insider Risk Management Hear from Microsoft CVP & CISO Bret Arsenault and his team about how they think about insider risk management: Insider Risk Management leverages the Microsoft Graph, security services and connectors to human resources (HR) systems like SAP, to obtain real-time native signals such as file activity, communications sentiment, abnormal user behaviors and resignation date. A set of configurable playbooks tailored specifically for risks – such as digital IP theft, confidentiality breach, and HR violations – use machine learning and intelligence to correlate these signals to identify hidden patterns and risks that traditional or manual methods might miss. Using intelligence allows the solution to focus on actual suspicious activities, so you don’t get overloaded with alerts. Furthermore, display names for risky users can be pseudonymized by default to maintain privacy and prevent bias. A comprehensive 360° view provides a curated and easy-to-understand visual summary of individual risks within your organization. This view includes an historical timeline of relevant in-scope activities and trends associated with each identified user. For example, you could see if a user submitted their resignation, downloaded some files and copied some of them to a USB device. The system also evaluates whether any of those files had classification labels on them and whether they contained sensitive information. With the right permission, the files accessed from Microsoft cloud resources like SharePoint Online can also be made available for the investigator to view, which further helps with the risk determination. Having all this information at your fingertips allows you to quickly decide whether this risk is one that warrants further investigation, saving you considerable time. Finally, end-to-end integrated workflows ensure that the right people across security, HR, legal and compliance are involved to quickly investigate and take action once a risk has been identified. For example, if the risk was determined to be unintentional, you could send an email saying this is a violation of company policy with a link to training or the policy handbook. If the risk was determined to be malicious, you could open an investigation that would collate and preserve all the evidence collected, including the documents, and create a case for legal and HR to take appropriate actions. Insider Risk Management is available as part of the Microsoft 365 E5 suite and is currently in limited private preview. You can sign up for an opportunity to participate here. Communication Compliance Communication Compliance is a brand-new solution that helps all organizations address code-of-conduct policy violations in company communications, while also helping organizations in regulated industries meet specific supervisory compliance requirements. Communication Compliance supports a number of company communications channels, including Exchange email, Teams, Skype for Business Online, Twitter, Facebook and Bloomberg instant messages. Organizations need the ability to improve investigating potential violations and facilitate taking adequate remediation action based on local regulations. To provide granularity in identifying specific words and phrases, we have three out-of-box machine learning models to identify physical violence, harassment, and profanities. You can also build-your-own trainable classifiers that understand meaning and context that are unique to your organization’s need such as insider trading or unethical practice, freeing you from a sea of false positives. Once a violation has been flagged and the designated supervisor is alerted, it is important that the review process enables them to efficiently act on violations. Communication Compliance includes features such as historical user context on past violations, conversation threading and keyword highlighting, which together allow the supervisor to quickly triage the violation and take the appropriate remediation actions. The interactive dashboard provides an effective way to manage the growing volume of communications risks to ensure violations aren’t missed. Proactive intelligent alerts on policy violations requiring immediate attention allows the supervisor to prioritize and focus on the most critical violations first. In addition, violations, actions and trends by policy provide a quick view on the effectiveness of your program. The Financial Industry Regulatory Authority (FINRA) Rule 3110 is a good example of a requirement for regulated organizations to have solutions in place to detect violations in communications. For example, safeguarding against potential money-laundering, insider trading, collusion, or bribery activities between broker-dealers is a critical priority. For organizations in regulated industries, Communication Compliances provides a full audit of review activities and tracking of policy implementation to help you meet the regulatory requirements you may be subject to. Communication Compliance is available today as part of the Microsoft 365 E5 suite, and you can sign up for a trial or navigate to the Microsoft 365 Compliance Center to get started today. We encourage customers who are currently using Supervision in Office 365 to use the new Communication Compliance solution to address your regulatory requirements with a much richer set of intelligent capabilities. **Update: Check out our session at Ignite 2019 that covers Insider Risk Management & Communication Compliance. Thank you, Talhah Mir, Principal Program Manager, Microsoft 365 Security and Compliance EngineeringAnnouncing the general availability of Insider Risk Management
A survey by Crowd Research Partners indicated that 90% of organizations feel vulnerable to insider risks and 53% confirmed insider risks against their organization in the previous 12 months. Insider Risk Management in Microsoft 365 helps you and your organization leverage machine learning to identify and action on insider risks. Our born-in-the-cloud multi-tenant solution is designed for scale and is currently processing over 2 billion audit events and emails daily. Since Insider Risk Management went to public preview in mid-January we have had tremendous customer engagement. The primary feedback from customers in the preview was the ability to quickly just get started, even without the need to deploy agents to configure manual data ingestion. Today, we move to the next phase and are excited to announce the general availability of Insider Risk Management. Now, in addition to multi-tenant customers worldwide being able to access this solution, customers in certain go-local datacenters can too. Insider Risk Management helps your organization leverage machine learning to identify and take action on insider threats by: Correlating native and third-party signals within tailored policy templates leveraging ML and AI to identify insider threats Ensuring employee privacy is built-in with controls Enabling end-to-end investigations with integrated workflows across IT, HR and legal teams Insider Risk Management will start rolling out to customer’s tenants in the coming days. Insider Risk Management is part of the Microsoft 365 E5 suite, and you can sign up for a trial or navigate to the Microsoft 365 compliance center to get started. Learn more about what’s new with Insider Risk Management and how to get started and configure policies in your tenant in this supporting documentation. We look forward to hearing your feedback. ** Successful insider risk management programs are built on a framework that identifies insider risks, quickly takes actions against those risks and matures the program through progressive iterations. Read more about building an effective insider risk program here. Thank you, -Talhah MirBecome an Insider Risk Management Ninja
We are very excited and pleased to announce this rendition of the Ninja Training Series. There are several videos and resources out there and the overall purpose of the Insider Risk Management Ninja training is to help you get the relevant resources to get started and become more proficient in this area.Use Communication Compliance to monitor Microsoft Teams, emails, manage risk and more
Announcing the general availability of Communication Compliance, part of the new insider risk management solution set in Microsoft 365, that helps minimize communication risks by helping you detect, capture, and take remediation actions for inappropriate messages in your organization. Now, all multi-tenant customers worldwide can access this solution today.
Introducing the Azure Threat Research Matrix
When performing a security assessment, it’s common to find the assessment team attribute their actions to the MITRE ATT&CK knowledge base so that high-level stakeholders can visually see what techniques were successful and defenders can understand the techniques that were performed. However, the commonly utilized MITRE knowledge base lacks formal documentation of Azure or AzureAD-related tactics, techniques, or procedures (TTPs) that assessment teams can attribute to. Over the past year, Microsoft has worked with some of the top Azure security researchers to create the Azure Threat Research Matrix (ATRM), a matrix that provides details around the tactics & techniques a potential adversary may use to compromise an Azure Resource or Azure Active Directory.Welcome to our podcast series on Uncovering Hidden Risks!
Listen to Uncovering Hidden Risks, a series of podcasts with top notch insider risk experts! While organizations have long prioritized external cybersecurity risks, many have not paid enough attention to the risks posed by trusted insiders in their organization. This is a mistake. Get ready to hear some great stories, gain a better understanding of insider risks and in the process learn something new.
How business conduct violations can help understand data security risks
Discover how the integration of Communication Compliance and Insider Risk Management enhances understanding of data security risks by providing deeper insights into user intent on potentially risky activities, ultimately aiding proactive management and safeguarding of sensitive assets within organizations.Announcing the public preview of Insider Risk Management
At Ignite last November, we announced Microsoft 365 Insider Risk Management and began a private preview. Since then, we’ve been hard at work developing the ability to scale and deliver a solution that leverages AI and automation to quickly identify and investigate insider risks. Today, we move to the next phase and announce the public preview of Insider Risk Management. Now, all multi-tenant customers worldwide can access this solution. Insider Risk Management helps your organization intelligently identify and take action on insider risks by: Ensuring employee privacy is built-in with anonymity controls Correlating native and third-party signals within tailored policy templates to intelligently identify insider threats Enabling end-to-end investigations with integrated workflows across IT, HR and legal teams As we start public preview, we’ll continue listening and taking feedback, to ensure we’re meeting your needs as we head toward general availability in the coming months. At general availability the solution will also be available in go-local environments with government following shortly thereafter. Insider Risk Management is part of the Microsoft 365 E5 suite, and you can sign up for a trial or navigate to the Microsoft 365 Compliance Center to get started today. **Ready to get started? Check out our getting started guide to learn how.
