Detect Anomalous Activity Ahead of a Data Breach With Heuristics

Develop Heuristics to Detect Anomalous Activity

No one knows your business better than you. You know when it looks normal or when it looks strange. If you don’t have an office in Shanghai, then why are there multiple login attempts from that location? If a financial analyst has never sent a file larger than 10MB, then why is he suddenly transferring 5GB zipped files to an unknown recipient? Any activity that doesn’t fit normal, everyday workflows likely indicates a potential breach or attack. You must develop heuristics to detect this anomalous activity and build a holistic, proactive defense that spans the entire third party workflow threat surface.

Third party workflow threats have a common theme: a user is the actor, and a file is the agent. Complete protection requires a defense that spans the full breadth of the associated threat surface: the collective paths of all files entering and exiting your organization. A comprehensive defense entails securing, monitoring, and managing all third party workflows, including secure email, SFTP, and secure file sharing, among others.

In my previous post, I explained the importance of bringing an organization’s entire security infrastructure to bear to secure your third party workflows. In this post, I’ll discuss the importance of developing and applying heuristics in order to detect anomalous activity along your workflows.

Develop heuristics to detect this anomalous activity

Take a Holistic Approach to External Threat Prevention

CISOs cannot cut corners when protecting sensitive information against third party workflow threats. They must instead create and maintain a comprehensive and well-rounded security infrastructure. Only a holistic defense that spans the entire threat surface provides complete protection against third party workflow threats. Every third party communication – email, MFT, SFTP, chat, and others – must be routed through a secure conduit that extends across the entire file transfer path. By locking down the entire path, you gain the ability to channel every file that enters or exits the organization through best-in-class security solutions, including SSO, LDAP, AV, ATP, DLP, and SIEM. Also, a single conduit for all your third party communications lets you see and protect the sensitive information you share with the outside world. Otherwise, you cannot protect what you cannot see.

Establish Benchmarks to Detect Anomalies

CISOs move from a reactive to a proactive defense once they have total control of the third party workflow threat surface. A CISO dashboard lets CISOs see and trace every file movement: upload, download, edit, send, receive, and more. CISOs utilize this granularity to create a tapestry of how the business interacts with the outside world. With this treasure trove of data, CISOs develop benchmarks of normal business activity and apply heuristics to detect anomalies. Why is the new financial analyst sharing a quarterly statement prior to the earnings press release? Why is someone in Engineering trying to access folders created by an HR director? CISOs with a thorough understanding of the business know this is unusual behavior. As a result, they can automatically respond to this anomalous activity before it becomes a threat, providing the ultimate defense of an organization’s most sensitive content.

Detect Anomalous Activity Ahead of a Data Breach With HeuristicsCISOs have a treasure trove of data at their disposal. Use it to develop heuristics and identify anomalous activity before it becomes a full-blown breach or attack.  [source: Accellion enterprise content firewall]

Now that you have your benchmarks in place for detecting and stopping anomalous activity, how do you help prevent breaches and malicious attacks from happening in the first place? In my final post in this series, I’ll discuss using automation to help stop threats before any lasting damage is done.

Don’t want to wait? Download the eBook now!
Ten Best Practices for Protecting Sensitive Content

Ten Best Practices for Protecting Sensitive Content

Explore the ten best practices that provide actionable steps you can take to build a holistic defense of the third party workflow threat surface.

*** This is a Security Bloggers Network syndicated blog from Cyber Security on Security Boulevard – Accellion authored by Cliff White. Read the original post at:

Avatar photo

Cliff White

Cliff White is Chief Technology Officer (CTO) at Accellion. Mr. White joined Accellion in 2011. He has more than 15 years of experience in the software industry and web-based technologies. He has also managed global engineering teams and advised C-level executives on software product engineering and best practices. Before joining Accellion, Mr. White developed highly scalable software for, an online media hosting company and one of the most visited websites on the internet. Previously, he led the engineering function for, a peer review and recommendation website for rental properties before it was acquired by

cliff-white has 24 posts and counting.See all posts by cliff-white