Category: Insider Risk Management
-
Compliance Unplugged Episode 6 – David and Joanne Discuss Insider Risk Management
A very important feature of Microsoft Purview and something that should be strongly considered for your Data Protection Program is Insider Risk Management. Joanne Klein and I feel it’s such an important part that we have made an entire series around it in Compliance Unplugged. In episode six, Joanne and I introduce Insider Risk Management…
-
An Overview of Copilot for Security
Unless you’ve been living under a proverbial technology-blocking rock, you’ve heard about Microsoft Copilot or at least ChatGPT by now. In essence, Copilot is designed to be an assistant (not a replacement) to users as they do their daily tasks. It integrates with common tools they use and assists in creating content, analyzing content, searching…
-
Microsoft Purview Insider Risk Management – Escalating an Alert in Insider Risk Management
In the previous Insider Risk Management (IRM) post, I covered the high-level steps and dashboards for reviewing alerts within IRM. In this post, we’ll take things a bit further by escalating an alert in insider risk management and following the process that allows analysts to gather and save the information necessary to review the larger…
-
Microsoft Purview Insider Risk Management – Reviewing Alerts In Insider Risk Management
In a previous post, I provided an overview of creating policies within Insider Risk Management (IRM). Once those policies are created, the activities of the users within the organization will begin to generate alerts. The alerts can be caused by accidental or benign activities, or they can be truly malicious in nature. It will be…
-
Microsoft Purview Insider Risk Management – Creating a Data Leak Policy
Although Microsoft Purview receives all kinds of signals from the various workloads within Microsoft 365, it doesn’t know what to do with the signals until you tell it what to do. This is the case with Microsoft Purview Information Protection (MPIP), Data Loss Prevention (DLP), and Insider Risk Management (IRM). The policy in IRM tells…