Microsoft sets out insider risk management guidance

What happened

Microsoft says organisations should manage security risks from trusted users before they lead to data loss or disruption, in undated guidance published on its Microsoft Security website.

The guidance covers employees, contractors and business partners who can access sensitive information. It describes insider risk management as identifying possible harm, assessing its seriousness and taking steps to reduce it.

Microsoft Security is the source of the guidance. The page is an educational overview that also promotes the company’s security products, rather than a report of an arrest, court case or specific breach.

Its central distinction is between the potential for harm and deliberate wrongdoing. A worker sending confidential information to the wrong person creates a security risk even without intending to damage the organisation.

The guidance also includes situations in which an outside attacker takes control of a trusted user’s account. In those cases, activity carried out through legitimate credentials may originate with someone outside the business rather than the employee concerned.

Microsoft places these issues in the context of hybrid working, cloud services and expanding use of artificial intelligence. It says organisations need to protect information across the different locations, devices and platforms employees use to do their jobs.

The background

Under Microsoft’s definition, insider risk includes both intentional and unintentional conduct, while an insider threat involves malicious intent. That distinction affects how an organisation interprets an incident: a mistake, a stolen account and a deliberate theft can require different responses.

The examples in the guidance range from lost devices and incorrectly configured cloud storage to employees taking customer information or intellectual property when they leave. It also identifies sabotage, espionage and misuse of privileged information for financial gain.

Trusted access makes these risks different from an attempt to break into a system from outside. Microsoft says people who already have permission to use sensitive information can be harder to detect when they misuse it.

Earlier Insider Threat Roundup reporting on Jack Teixeira’s sentence for leaking classified information illustrates the deliberate misuse of work access. The former US Air National Guardsman searched for material unrelated to his duties and shared hundreds of pages of classified defence information online.

The consequences can also extend beyond information being copied or disclosed. In a separate case, a former contractor employee was sentenced after disabling water treatment monitoring software at California’s Discovery Bay facility, illustrating the operational dimension of insider misuse.

Microsoft identifies financial loss, interruption to services and damage to customer trust among the possible effects of unmanaged risk. It also points to recovery expenses, legal costs and potential regulatory penalties where incidents involve failures to meet data protection requirements.

Data loss prevention is one part of the response, rather than another name for the whole programme. These tools focus on controlling the sharing, downloading or transfer of sensitive information; insider risk management also covers access permissions, staff behaviour, policies and incident handling.

A further distinction concerns detection and proof. In a hypothetical example, Microsoft describes an employee accessing an unusually large number of sensitive files or attempting a transfer to external storage. It says such activity should prompt investigation to establish whether there is a legitimate business reason.

What people are saying

Microsoft says security monitoring needs to be balanced against employee privacy and trust. Its guidance calls for transparent policies explaining why activity is being examined and how far that monitoring extends, particularly when communications are involved.

The company identifies AI and machine learning as technologies increasingly used to analyse activity and find departures from normal behaviour. It says these systems can reduce false alerts and improve response times, although the supplied page provides no measurements demonstrating those benefits.

Microsoft also says combining records from different sources can help security teams recognise patterns that would otherwise be difficult to see. It lists user activity logs, communications records and reports of system access as sources for that analysis.

For distributed workforces, the guidance describes cloud-based security tools as a way to bring detection, encryption and access controls together. Microsoft says these services can adapt as an organisation’s requirements change.

The page presents Microsoft Purview as a product for examining potentially risky activity, investigating events and protecting sensitive information, including in AI-enabled services. These are the supplier’s descriptions of its capabilities, not findings from an independent product assessment.

What happens next

The guidance sets out an ongoing management process rather than a dated implementation plan. Its proposed starting point is a risk assessment examining staff responsibilities, access rights and behaviour, with priorities determined by the likelihood and potential impact of harm.

Access controls should then reflect what each person needs for their current job, Microsoft says. This approach, known as least privilege, limits permissions rather than granting broad access by default. The guidance uses a role change as an example of when older permissions may need to be removed.

For sensitive systems, Microsoft recommends multifactor authentication, which requires more than one method of verifying identity. This addresses the risk of someone gaining access using stolen login details alone.

Written rules should explain acceptable data use and how policy breaches will be handled. The guidance recommends reinforcing those rules through regular training on information protection, phishing and other attempts to deceive employees into giving up access or information.

Technical safeguards include encryption to protect information while it is stored and transferred, and data masking to conceal sensitive details. These measures serve a different purpose from behavioural monitoring: they protect the information itself rather than identifying unusual activity around it.

Microsoft recommends involving security, IT, human resources, legal and compliance staff in the programme. It says coordinated response plans should establish how concerns are detected, passed to the appropriate team, investigated and contained.

Exercises and simulations can help test those arrangements before a real incident. After an incident, the guidance calls for an examination of what happened and corrective action to address weaknesses, making the response a basis for improving controls rather than simply closing an investigation.