Insider Threats Packing Their Bags With Corporate Data
summary
Analysis on 4.7 million active users shows 58,314 users drop from activity; about 15% upload to personal cloud before departure and 2% perform policy‑violating exfiltration. Detection combines inline forward proxy logs and API audit logs, instance labeling (business vs personal), DLP data labels and anomaly detection on volume. Seventy‑five percent of suspect uploads happen in the last 50 days, and ~80–97% of exfiltrated files land in Gmail, Google Drive or OneDrive.
AI-written summary · about
chapters (10)
- 0:00Insider threats overview
- 2:28Why insider threats matter now
- 3:53Defining insider threats
- 6:44Data sources and labeling
- 9:36Trends in departing employees
- 12:45Malicious insiders stealing data
- 14:30Detecting threats with volume and direction
- 18:41Research scope and limits
- 20:28Key takeaways and proactive steps
- 21:51Q&A
related talks
48mData-Driven Cyber Indicators of Malicious Insider Threat
41mCollaboration Without Data Loss: Keep IP From Leaking to Competitors
40mA Data Protection Problem: Insider Risk
43mWhy Source Code Exfiltration Is the Biggest Blind Spot in Insider Threat
31mThe Return of Hacktivism – The Insider
01h 06mKeynote: Online Child Sexual Abuse Material (CSAM): The Insider Attack You Have Not Seen Coming
22mTechnical Tracks
15mSecret Tips to Reduce Insider Threat Risks with Behavioral AI