Behavioral analytics prevent insider threats in HIPAA compliant email accounts by detecting unusual activity patterns like unauthorized access or large data transfers.
Understanding how insider threats exploit email systems
Insider threats are security risks from within the organization, such as employees or contractors misusing access to sensitive information for nefarious purposes. According to a study published in IEEE Communications Surveys & Tutorials Vol 20, “...74% of these breaches were originated by insiders. Thus addressing threats posed by insiders is the top priority for achieving full protection of networked infrastructures…”
The threat in a healthcare organization often centers around exploiting access to electronic health records and email systems that contain a wealth of protected health information (PHI). Employees either send third parties sensitive information or possibly accidentally send PHI to third parties. These third parties use this information to exploit the organization.
How behavioral analytics improves threat prevention
Behavioral analytics continuously monitor and analyze how users typically interact with email like login times, locations, attachments, or frequency of communication. When deviations from normal behavior occur, like a user accessing an email from an unusual location or sending large amounts of sensitive data, behavioral analytics flags these anomalies for further investigation.
Where email systems often contain PHI, behavioral analytics is a tool in preventing unauthorized access. It acts as a preventative method for insider threats at intial signs of unusual employee activity.
Best practices for using behavioral analytics to prevent insider threats
- Establish baseline user behavior to monitor and record normal email activities for each user. It helps create a baseline to quickly identify deviations that might indicate a threat.
- Set real time alerts for anomalies to configure behavioral analytics tools to trigger immediate alerts when unusual activities occur.
- Pay special attention to employees with elevated access to PHI like IT admin or senior staff. Integrate email filtering systems with behavioral analytics with email filtering tools to prevent suspicious emails from being sent of received.
- Periodically recalibrate behavioral analytics models to account for changes in user behavior like new work schedules or devices.
- Tailor the behavioral analytics system to monitor email activity based on the user's role. Different roles require different levels of access so identifying abnormal activities within each role specific context improves threat detection.
FAQs
What are examples of suspicious behaviors through email?
Sending large volumes of emails to external addresses, accessing sensitive data outside of normal work hours, or using unfamiliar devices to log in.
How is the PHI acquired by threat actors commonly used?
It is commonly used for identity theft, fraud, or blackmail.
What is unauthorized access?
It occurs when someone gains entry to a system or data without proper permission or credentials.
Kirsten Peremore
