BROADCASTS.com

Jane Lo, Singapore Correspondent speaks with Dagmawi Mulugeta, Threat researcher with Netskope Threat Labs.Dagmawi has his OSCP and has previously worked at Cyrisk (a subsidiary of 4A Security), Sift Security (acquired by Netskope), and ECFMG as a researcher, security engineer, and developer. He has innate interests in public CTFs, exploit development, and abuse of cloud apps. He has his MSc in Cybersecurity from Drexel University.In this interview, Dagmawi shared the behavioural insights found for employees preparing to leave, and how these indicators could enable organizations to protect their data more effectively.He noted the concern that many organisations have with \u201cflight risk\u201d users \u2013 that is, employees that are getting ready to leave \u2013 taking corporate data with them.A common question to address this concern, is how to efficiently identify such risks - without sifting through hundreds of alerts and spending hundreds of man-hours.Dagmawi shared how they approached this problem by analysing anonymized data of over 4 million users from more than 200 different organizations worldwide., and some interesting key revelations: (i) 15% of leavers used personal cloud apps (e.g. Google drive, Gmail) to take data with them (ii) 2% were violating corporate policy (exfiltrating sensitive corporate information) (iii) majority of the data movement happens 50 days before leaving.Dagmawi highlighted how they identified three key signals to filter out alerts with potential flight risks:a) volume \u2013 identifying whether the data being moved is anomalous for the individual in the organisationb) nature of data \u2013 whether the data being moved is sensitivec) direction \u2013 whether the cloud application is outside of the organisation\u2019s management (e.g. google drive).Wrapping up, Dagmawi recommended that encoding the three signals into the detection systems could help reduce the size for reviews by 43x \u2013 that is, for every 50 alerts, the signals could help to filter out the 1 or 2 concerning ones.Recorded 11th May 2023, 3.30pm, Black Hat Asia 2023, Singapore Marina Bay Sands.#bhasia#mysecuritytv #insiderthreat