View Insider Risk Trends for your organization

Overview

The Insider Risk Trends dashboard shows how risk in your organization changes over time. The dashboard tracks fluctuations in these important metrics:

• The number of users causing critical or high severity file events
• The departments in your organization that cause the most untrusted events
• The types of files involved in exfiltration events
• The sources of company data being put at risk
• The vectors or destinations on which the most untrusted activity commonly occurs

You can use these trends to identify where to focus controls, training, and engagement to improve your organization's risk profile.

Considerations

• To use this functionality, Incydr users must be assigned specific roles. For more information, see Permissions for Incydr. 

• Add trusted activity and data connections to focus your investigations on higher-risk file activity. Adding trust settings allows Incydr to show only untrusted file events on security event dashboards, user profiles, and alerts, reducing your total file event volume. All file activity is still visible in Forensic Search.

• The dashboard aggregates the data Code42 collects over time and requires at least 30 days of data. If your dashboard is empty, you may need to enable endpoint monitoring, connect your cloud services, and allow Code42 enough time to aggregate that data.

The Insider Risk Trends dashboard

To access the dashboard:

1. Sign into the Code42 console.
2. Select Dashboards > Insider Risk Trends.
   The dashboard opens.
   
   Click any of the links below for more information.
   1. Trust settings: Indicates that your trust settings apply to this dashboard. Code42 excludes trusted file activity as defined by these settings and any cloud data connections monitored by Code42.
   2. Risk settings: Click to open Risk settings where you can set the score of each risk indicator. These scores are used to calculate the severity of each file event.
   3. Risk in my environment: The number of users who have caused critical or high severity events over the specified time frame.
   4. Users putting data at risk: The departments whose users have caused the most untrusted events over the specified time frame.
   5. Files being exfiltrated: The types of files (organized by category) involved in the most untrusted events over the specified time frame.
   6. Sources being put at risk: The sources of data from company sources involved in the untrusted or exflitration events that occurred over the specified time frame.
   7. Vectors for untrusted activity: The vectors (or destinations) on which the most untrusted events commonly occur over the specified time frame.
3. In the graphs on any panel, hover the mouse over the graph for more detail regarding those totals.
4. Use any of the controls to change the view on that panel.
   1. Click Sort to sort the view in either ascending or descending order, based on your selection from the menu that opens.
   2. Click Filter to view only specific departments, file types, or destinations on the corresponding panel.
   3. Click an item in the legend at the bottom of the graph to show or hide that detail in the panel.
   4. Use the controls at the bottom of the graph to view more categories in the panel or to scroll to other hidden pages on the panel.
   5. On the Vectors for untrusted activity panel, click a linked category name (or its graph) to drill down and view more detailed information. Click Back to return to the top-level category view.

Use cases

The panels on the Insider Risk Trends dashboard all work together to help you refine your organization's security program and improve your risk posture over time.

• Use the entire dashboard to measure the effectiveness of all facets of your organization's security program. If your security program is in development, this dashboard can help you identify where best to focus additional attention to improve your risk posture. For robust security programs, these trends can help you determine whether reminders or additional engagement and training might be needed.
• Use the Risk in my environment panel along with the Users putting data at risk panel to correlate increased event totals to your organization's events, such as product releases, conference appearances, or project kickoffs. You can then plan to update trusted activity settings for approved sharing platforms or increase security training outreach for specific departments for similar events in the future to filter out approved sharing or proactively prevent such events.
• Use the users, files, and vectors panels together to identify approved sharing and fine-tune trusted activity settings. For example:
  • The Users putting data at risk panel shows that your Software Development department has the highest amount of untrusted activity.
  • The Files being exfiltrated panel indicates that source code files are often involved in untrusted events.
  • The Vectors for untrusted activity panel shows that source code repositories are a frequent vector for exfiltration events.
  This combination may indicate that developers are causing a high number of security events as they check source code files in and out of your corporate repository as part of day-to-day work. By adding your corporate repository to your trusted activity settings, you identify such activity as trusted and prevent it from appearing on dashboards.

Related topics