Insider Threat Detection & Response

Not All Threats Come from Outside Your Organization

Protecting Against the Threat Within

Some of the largest corporate data losses have been the result of insider threats. Trusting employees is not something to be taken lightly, especially in key roles like finance, human resources and information technology. GoSecure Insider Threat Protection provides visibility, and mitigating response, when key personnel are performing suspicious actions.

People are busy, performing a myriad of actions every day. In the midst of the daily routine, how are security teams to know when an employee is performing a suspicious activity, and then monitor said action? GoSecure Insider Threat Protection (ITP) allows you to identify key personnel, and suspicious actions, which triggers various types of monitoring and response. In addition, with over 50 unique insider threat event types, GoSecure ITP delivers industry leading visibility, providing almost unlimited flexibility for creating ITP rules.

Features

Flexible Rulesets

With over 50 unique insider threat event types, rulesets can be created to account for an almost unlimited number of scenarios. Combine personnel with actions to create the rules that meet your exact requirements.

Screen Recording

Based on rules created using the GoSecure SPY security language, as suspicious activity is created, screen recording can be automatically triggered and stored for future reference.

Key Logging

Similar to screen recording, key logging can store all keyboard activity based on ITP rules, saving the activity for future use.

Deny, Delay, Degrade

When potentially malicious activity is identified, sometimes the prudent response is to let the activity continue, albeit with mitigating response. GoSecure ITP provides the three Ds of insider protection – Deny, Delay or Degrade. Deny stops the activity, delay slows it so you can better monitor exactly what is happening and degrade makes it look like the activity completed, but the sensitive data was not actually exfiltrated.

SSL Introspection

As more web traffic is encrypted, monitoring this important communication channel becomes more difficult. SSL Introspection provides visibility into outgoing requests before the browser encrypts the communication.

Increased Visibility for Advanced Correlation

Insider threat specific alerts enhance GoSecure’s multi-observational analysis beyond traditional MDR providers. More importantly, combining insider threat alerts with endpoint, network and email threat alerts provides an unmatched level of visibility. This visibility allows GoSecure to correlate more accurately and respond earlier. Protect your organization from external, and internal, threats with GoSecure Managed Detection and Response.

Related Resources