In the present-day business ecosystem, organisational security, compliance, and performance are pivotal aspects that warrant consistent attention. Among these, understanding how sensitive data moves through the organisation, and detecting insider risk early, are increasingly becoming significant areas of focus. Most organisations already have existing log sources, particularly in Microsoft 365 and their current security tooling, that contain abundant information to provide visibility into risky handling of data. This article elaborates on the importance of utilising these logs effectively and integrating insider risk visibility with existing systems.
Understanding Existing Resources
Many organisations are flooded with log sources but often do nothing with them. Microsoft 365 alone records a great deal of activity across email, SharePoint, OneDrive and Teams. These logs can be an invaluable source of information about potential fraud, data leakage, and other non-compliant handling of data. The challenge lies in recognising the potential of these logs and integrating them into a structured, proportionate insider risk framework.
The Danger of Late Action
The underuse of activity logs is a common problem faced by many organisations. Often, logs are only consulted after an incident, to piece together what happened. That retrospective analysis has its place, but it does not prevent the damage; it functions as a post-mortem investigation. A proactive approach is necessary to harness the full potential of the data at hand.
Utilising Logs Efficiently
Interestingly, it is often possible to gain meaningful insider risk visibility using only a fraction of the logs collected by organisations. This reinforces the importance of understanding the nature of the insider risk and assessing what activity actually needs to be looked at.
A well-thought-out strategy begins with assessing the risk associated with insiders. Risks may be related to fraud, data leakage, or other non-compliant behaviour, and most of it is negligent or accidental rather than malicious. Identifying these risks helps in defining what logs are essential and how they should be used, eliminating the wastage of resources in collecting and storing unnecessary data. It also keeps the program proportionate: collecting only what you need is fairer to employees and easier to explain to them.
Insider Risk: A Business Responsibility
The task of managing insider risk is not merely an IT problem but a comprehensive business responsibility. It is an area that involves all departments, making it crucial to integrate them into an insider risk program. Every segment of the organisation, from human resources to legal to operations, should be aligned with this program, and staff should know what is in place and why.
The Challenge of Proper Oversight
Often, it is almost impossible for internal security teams to run insider risk programs properly on their own. The complexity of the task, the diversity of data sources, and the continuous evolution of risks makes it a specialised area.
Many businesses also turn to managed service providers for this task, but they are not always the right organisations to manage insider risk programs. A specialised insider risk platform is often required, utilising experts who understand insider risk intricately.
The Need for Specialised Insider Risk Platforms
The critical aspect of managing insider risk lies in employing specialised insider risk platforms that are utilised and resourced by professionals who understand the nuances of insider risk. These platforms should build on the systems you already have, not replace them, and turn existing activity into actionable insights.
ShadowSight, for example, is a Microsoft 365 security intelligence platform. Its Data Leakage Prevention module adds a behavioural detection layer on top of Microsoft 365 activity, catching data loss that looks like ordinary, legitimate work and that native Microsoft 365 DLP rules miss, such as data moving to personal email or AI tools. Every alert is validated by analysts before it reaches you. The platform can be managed by ShadowSight’s analysts, your own team, or a mix of both, so it fits around the security team and tooling you already have.
The Last Consideration: New Endpoint Agents
One of the last considerations in this process should be to deploy new endpoint agents to collect yet more data. While such tools have their uses, they add cost, deployment effort and another source of data to manage, and they should not replace or overshadow the utilisation of the logs you already hold.
Start with what you have. ShadowSight connects through one read-only Microsoft 365 admin consent, with no endpoint agents (only a lightweight collector if Windows file shares are included). Content is analysed in place, and customer data is stored in the Azure region where your business is located.
In Summary
The complexity of managing insider risk requires a well-strategised approach that goes beyond mere data collection. Organisations must leverage existing log sources, especially Microsoft 365, to their fullest potential and integrate them into a program that involves all departments. The mere collection of data, without proper analysis and actionable insights, leads to ineffective oversight and possible failures in risk management. In a time when data breaches and insider incidents are common, organisations should consider moving away from purely post-event analysis and aim for a proactive, proportionate and specialised approach. The focus should be on utilising existing resources efficiently, integrating all departments into a comprehensive insider risk program, and employing specialised insider risk platforms. Doing so will not only streamline the process but also contribute significantly to the overall security and compliance of the organisation.
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.