Code42 adds customizable insider risk alerts to Incydr

Data recovery and cybersecurity provider Code42 has added custom insider risk indicators (IRIs) to Incydr, its SaaS-based data protection software designed to allow security teams to detect and respond to information exposure and exfiltration from corporate computers, cloud-based systems, and email programs.

The new IRI capability is available immediately as part of Incydr at no extra cost to users, and aimed at enabling security teams to customize their insider risk alerts based on needs specific to their business and industry, allowing prioritization of sensitive events.

"While there is often heightened attention and numerous protections placed on highly-regulated data, it has been historically difficult for businesses to protect their intellectual property and strategic data from insider events," the company said in a news release. "With the new IRIs, Code42 Incydr data protection allows teams to prioritize and focus their efforts on their most important files."

IRI allows domain specific customization

As intellectual property and business-specific data differ across business sectors, Code42 Incydr's new IRI capability will enable security teams to define and customize alerts for specific and relevant file types. This can be done by adjusting the risk settings to add more weight to certain file names, types, sources, and destinations.

"If insider risk management is important to an organization, then customization and tailoring to the environment is much better than not having that available," said Michael Sampson, an analyst at Osterman Research. "Minimizing false positives and false negatives in such environments is critical to not overwhelming analysts."

A manufacturing company, for instance, can heavily weight their CAD drawings, just as technology companies can prioritize data being moved from high-value sources, such as Git repositories, according to Code42.

In addition to custom IRIs, Code42 Incydr data protection allows security teams to adjust their response to alerts, including by blocking unacceptable user activity.

Sampson said that different types of insider threats may require different responses.

"There's the accidental one, which is best handled by questioning the employee to confirm if they are doing what they intend to do," Sampson said. "Then there's the malicious one, where insiders seek to steal something that isn't theirs to take, e.g., IP, confidential data. In that case, it should be quietly intercepted, blocked, and escalated for mitigation, e.g., interaction with the employee, or greater monitoring of what they are doing."