What access controls do you place on engineers to prevent insider threat?

Question

Answer

A #ZeroTrust foundation with proper logging/alerting combined with the tried and true approach of 'least privileges'. It's about having context around behaviors, not draconian controls

Answer

Agree with on zero trust. Specifically for me, as soon as possible eliminate shared access accounts and in-application “god view” and support access without user notification/approval workflows.

Shifting security both left into development and right into operations means making processes to be performed safe, automated, and auditable.

Answer

Zero Trust practices
Eliminate admins or supervisor-mode accounts as much as you can.

Implement and review logs, implement tools to detect uncommon behaviors
Make sure your backups are working fine (and recovery)
Implement info protection policies using active directory or other tools

Answer

While we don’t use these, Security User Behavior Analytics (SUBA) & User Behavior Analytics (UEBA) tools are gaining popularity.

But….these can’t be used in a vacuum. An effective insider threat program is a significant effort.

What access controls do you place on engineers to prevent insider threat?

Content you might like

If you had a magic wand - what's the #1 daily business challenge you'd eliminate?

What cyber threat are you most concerned about?

What headline-trend or buzzword makes you cringe the most?

Any recommendations on OT security product? I tried pushing Crowdstrike but it wasn't approved by OEMs. Other two are Claroty and Nozomi. Any feedback either on above two or any other as per your experience?