Huntress sets out insider risk management guidance

What happened

Huntress has set out guidance on managing insider risks, recommending that organisations examine user behaviour alongside controls designed to prevent sensitive data leaving their systems.

The online guide, credited to Lizzie Danielson, is the source for this report. The supplied material gives no publication date and describes security practices rather than a particular breach, arrest or court case.

Its scope extends beyond employees to contractors, vendors and others with access to an organisation’s systems, information or internal knowledge. That makes access, rather than employment status alone, central to deciding which risks to assess.

Huntress identifies three categories: people who deliberately misuse their access, those whose mistakes or disregard for rules cause harm, and users whose accounts have been taken over by attackers. The categories distinguish harmful intent from accidental exposure and activity carried out through stolen credentials.

The background

The guide separates insider risk management from data loss prevention, usually shortened to DLP. DLP focuses on stopping sensitive information from being lost, stolen, improperly shared or accessed without authorisation.

Those controls can cover information moving through email and file transfers, material held in databases or cloud storage, and data being used on computers. Huntress gives the example of blocking an attempt to send customer credit card details to a personal email account.

Insider risk management examines a wider set of signals, including which resources someone accesses, how their activity changes and the circumstances surrounding it. The distinction is between controlling what happens to information and investigating the behaviour that may put it at risk.

To illustrate that behaviour, Huntress uses a fictional employee who begins looking for another job after missing out on promotion. The employee then accesses financial reports, client lists and research outside her usual work, downloads substantial amounts of data to a USB drive and sends confidential documents to a personal account. This is an illustrative scenario, not a reported incident.

Other examples show why the response cannot depend on file movement alone. An administrator might deliberately inspect confidential personnel records, while a contractor could expose sensitive documents by mistakenly placing them in a publicly accessible cloud folder.

The guide also describes an external attacker using credentials stolen through phishing — a deceptive message intended to obtain information such as login details. In that situation, activity through an employee’s account does not mean the employee chose to steal data.

The approach overlaps with Mimecast’s guidance on examining data exposure, which recommends reviewing file movements and account activity whether the cause is deliberate or accidental. It reflects a shared emphasis in these guides on understanding how information is exposed, rather than treating every incident as employee misconduct.

What people are saying

Huntress says analysts should review security alerts to separate genuine threats from false positives — warnings about activity that turns out not to be harmful. When an alert needs investigation, the guide recommends examining access records, email activity and file transfers.

The company says analysts should work with human resources and legal colleagues so investigations are handled appropriately and comply with privacy laws. It presents the role as requiring technical knowledge, judgement and sensitivity when dealing with people.

Huntress also recommends adjusting detection rules over time. Its examples include changing the level of activity that triggers an alert, monitoring additional behavioural patterns and incorporating further sources of information.

The guide says incidents should be documented for possible legal proceedings, compliance audits or internal reviews. This places record-keeping alongside detection and investigation as part of the analyst’s responsibilities.

Huntress argues that managing insider risk should not mean assuming staff intend to cause harm. Its guidance instead advocates acknowledging and addressing risks while preserving trust and allowing people to do their work.

What happens next

The guide offers a framework for organisations to implement, rather than announcing a forthcoming investigation, product release or deadline. Its first step is to identify the information and systems whose compromise would cause the greatest damage, so protection can be prioritised.

It then recommends establishing a picture of ordinary user activity. Knowing what people normally access and do provides a reference point for spotting departures from established working patterns.

Clear policies are another part of the framework. Huntress recommends explaining how staff should handle information, use company systems and follow access rules, with the aim of reducing avoidable mistakes.

For technology selection, the guide recommends tools that analyse behaviour, issue alerts promptly and work with an organisation’s existing security systems. These capabilities are presented as components of a broader programme, not a substitute for policies and investigation.

Staff training should explain insider risks and how to report suspicious activity without fear of retaliation, according to the guide. Organisations should also prepare a response plan setting out who will be involved, what actions they will take and how they will limit damage.

The attention to both monitoring and employee trust is also present in Microsoft’s insider risk management guidance, which addresses accidental exposure, deliberate misuse and compromised accounts while balancing security monitoring with privacy. Together, the guides place organisational responsibilities alongside technical controls.