Cyber Defense eMagazine November 2019

Centralized Logs
The tool should have the ability to ingest a variety of technical and non-technical indicators of use activity.
This is typically done using connector and collectors of various types depending on the target system.
Normalize, Aggregate, and Correlate
The tool should have the ability to normalize, aggregate, and summarize the user activity in preparation
for data analysis and machine learning.
Insider Threat Specific Content
The tool should come with the necessary out-of-the-box content to meet your basic insider threat
monitoring needs. It should also provide the ability to create custom content for industry-specific use case
requirements. The detection mechanism should consist of standard rule-based violation triggers and user
behavior-based anomaly detection. It is this combination that proves to be most effective against insider
threats.
Threat Chains
Once the nefarious behavior is detected, the tool should facilitate stitching or chaining individual events
into one holistic threat. For example: a user who has been identified as a flight risk is identified as
accessing and downloading an abnormal amount or type of data, followed by an attempt to exfiltrate that
data.
Risk Scoring
Once the insider threat behavior has been detected using threat chains, these alerts need to be risk
scored in order to prioritize the threats from the noise.
Investigation Tools
When it comes to insider threats, the situation is seldom black and white. The security analyst requires a
tool that can provide the necessary context in order to be able to complete their investigation of the
prioritized threats.
50