Insights into insider threats: Detecting and monitoring abnormal user activity

A cyber security risk that comes from within an organization is referred to as an insider threat. Insider threats might be carried out purposefully or accidentally. Whatever the motivation, compromised enterprise systems are the ultimate results.

In this Help Net Security video, Andrew Hollister, CISO at LogRhythm, discusses how organizations focus their threat detection and prevention strategies on external actors. Still, internal threats can cause just as much harm.

Remote working has opened up access opportunities for users, with employees now being able to log into devices anytime, anywhere. With many individual users to manage, it can be hard to monitor dispersed employees and pinpoint unusual behaviors.

Organizations can stop potential insider threats in their tracks by deploying deterministic rules and machine learning for identifying abnormal behaviors.