- SAAS SECURITY PLATFORM
- USE CASES
By Use Case
- INTEGRATIONS
- RESOURCES
- COMPANY
As an MSP, your day-to-day activities are pretty diverse.
You lead cybersecurity training for your customers, monitor their SaaS app usage, lock down accounts that behave suspiciously and build strategies to prevent account compromises.
But most of that work is in service of the same goal: to prevent data exfiltration.
Data exfiltration might sound like a fancy name — but it’s pretty simple. It just involves hackers moving data from a platform where it’s authorized (like a company’s shared drive) to … somewhere else.
Bad actors could exfiltrate any kind of data from an organization or end-user account: financial information, employee records, intellectual property, sensitive data like Social Security numbers and more.
In other words, the stuff you really don’t want to fall into the wrong hands.
Data exfiltration is annoying — but also expensive.
According to IBM’s Cost of Data Breach Report, the global average cost of a data breach is $4.35 million. That’s a 13% increase in just a two-year period.
Sensitive SaaS data has been exposed in about 81% of organizations. These compromises can lead to a laundry list of business impacts, from data and financial losses to compliance problems.
Stopping breaches ASAP and limiting data exfiltration can mean a lot of good things for your customers:
Every end-user account is attached to a specific person. Each person has their own job duties. And for every person, there will be different levels of expected file activity based on their role.
For example, Daniel from HR might conceivably download 100 files in an hour if he’s combing through submitted resumes for a job opening.
But Addison, the in-house attorney? What’s she doing downloading that many files?
Your job is to keep tabs on everyone’s user behavior — and jump into action when someone’s account crosses over into suspicious territory.
Related Content: Data Loss Prevention
But you can’t always be online 24/7 to see when Addison’s download activity started becoming atypical. It’s also next to impossible for a human to review hours of activity logs — and still have the brain power to spot a problem.
That’s when you need to enlist the help of software that offers continuous alerts for suspicious activity.
If someone is robbing your house, you’d like to know as soon as possible, right? Before they start throwing your valuables in a duffel bag?
The same concept can be applied to cybersecurity. You want a real-time alarm system that lets you know when someone has broken into an account — and is throwing data into a (virtual) duffel bag.
Developing incident response plans is also important. If your team knows what to do as soon as they get a data exfiltration alert, you have a better chance of limiting the damage.
A solid incident response plan will include:
The SaaS Alerts platform monitors patterns of data sharing, downloads and deletion. (Yes, even deletion is important to keep track of! It’s usually the last step someone takes after they’ve exfiltrated data.)
Remember Daniel and Addison from above? Each user account you monitor will come with its own expected levels of file-sharing activity.
Within SaaS Alerts, you can match specific accounts with specific activity limits. Ideally, you would do this in conjunction with your customer, who is more familiar with each role within the organization.
Then, once an account surpasses its designated activity limit, an alert is triggered.
MSPs can also set up automatic remediations using SaaS Alerts’ Respond module. These remediations (like account lockdown after downloading more than 50 files in an hour) jump into action right after an alert — so you don’t have to worry if you’re off the clock.
Related Content: How ArcLight Solutions Used SaaS Alerts’ File-Activity Alerts to Take Down a Chinese Spy
