Building an effective Insider Threat program is a team sport, and requires the involvement of not only the security team, but also legal, HR, compliance, and many other professionals in the organization. The goal of our new “Professionals” series is to help security teams navigate their relationship to other roles within an Insider Threat program. Ideally, knowledge of the complex nature of Insider Threats can help speed incident response and establish the right policies and procedures for prevention.
To kick off our series, we’ll explore the idea relationship between security and legal teams within an Insider Threat program, including division of responsibilities, how to establish best practices, and what to do when an actual incident takes place.
How Legal Can Help Establish Insider Threat Best Practices
An important theme when establishing an Insider Threat program is balancing security and user privacy. The former involves protecting organizational assets – including people, information, facilities, intellectual property, and brand reputation. The latter includes ensuring that employees are not subjected to invasive intrusions that breach their reasonable expectations of privacy.
To make sure that security and privacy are effectively balanced, security teams should consult a legal professional on topics such as relevant employment laws and user privacy rights. Legal teams can also walk through a list of things to consider to help mitigate Insider Threats from a policy perspective, as well as adequately protect employees with the proper disclosures.
For example, most U.S. states abide by “at-will” employment laws, which give employers the ability to leverage user activity monitoring, among other types of monitoring, as a condition of employment. Most states do not require employers to obtain employee “consent to monitor,” although it is a best practice to do so. A legal professional can help security teams navigate the proper documentation for this type of consent, and similar types of issues. In addition, Insider Threat Management tools like ObserveIT can take user privacy a step further by anonymizing user data on an ongoing basis during the monitoring process, particularly personally identifiable information (PII).
Finally, it is increasingly important to implement clear security policies and training programs. These set the tone of the company culture and demonstrate transparency, while promoting understanding of boundaries and parameters that are necessary to keep the company secure. Documentation of policies can also be used as evidence to show knowledge and training in support of discrimination lawsuits, and unlawful termination lawsuits. Security teams should work with legal to review corporate policies, and ensure the proper documentation is in place as evidence of training.
Working with Legal to Navigate an Insider Threat Incident
In the event of an Insider Threat incident, the entire cross-disciplinary team must spring into action during incident response. Specifically, legal should be prepared to help security teams navigate some of the timelines and communications around breach disclosure, in tight coordination with local compliance regulations. It’s important to also note that at the outset, organizations should have a lawyer thoroughly review which local, national, or international laws apply as you develop security and privacy policies.
For example, under GDPR article 33, organizations need to notify authorities of a data breach within 72 hours of becoming aware of it. Beyond notifying authorities, teams must comply with specific local regulations and timelines around customer disclosures. In addition, any statements regarding the data breach (such as blogs, social media posts, press releases, customer emails, or internal employee communications) should be thoroughly reviewed by legal.
During the Insider Threat investigation process, once evidence is gathered by the security team, legal can use reports from tools like ObserveIT that indicate who did what, when, where and why to build a case as needed. After a thorough review of the evidence, legal and HR can coordinate around the appropriate resolution for the responsible employee or employees. While some incidents may warrant termination or disciplinary action, others are caused by unintentional user actions, which can often be remedied with further cybersecurity awareness training.
Want to know more about how security and legal teams interact within an Insider Threat program? Download our Ultimate Guide to Building an Insider Threat Program today!