--- title: Protect your unstructured data with user behavior analytics description: Protect your unstructured data with user behavior analytics --- [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/head-logo-2.svg "TowerWall")](https://towerwall.com/) [![TowerWall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/towerwall-logo-white-test.svg "TowerWall")](https://towerwall.com/) - [Our Partners](https://towerwall.com/how-we-protect-you/our-technology-partners/) - Our Solutions - - Our Cybersecurity Solutions - We operationalize infosec, building security solutions that safeguard your most critical assets. - - [Solutions Overview](https://towerwall.com/cybersecurity-solutions/) - [Risk Assessments & Security Reviews](https://towerwall.com/cybersecurity-solutions/risk-assessments-security-reviews/) - [Program & Policy Development](https://towerwall.com/cybersecurity-solutions/program-policy-development/) - [Incident Response & Remediation](https://towerwall.com/cybersecurity-solutions/incident-response-remediation/) - [Managed Detection & Response](https://towerwall.com/cybersecurity-solutions/managed-detection-response/) - - [Compliance & Privacy](https://towerwall.com/cybersecurity-solutions/compliance-privacy/) - [Comprehensive Security Training](https://towerwall.com/cybersecurity-solutions/comprehensive-security-training/) - [Vulnerability Protection](https://towerwall.com/cybersecurity-solutions/vulnerability-protection/) - [Penetration Testing](https://towerwall.com/cybersecurity-solutions/penetration-testing/) - Virtual Security Officers - - Virtual Security Officer - Leverage the experience and security acumen of Towerwall’s on-demand security experts. - - [Virtual Chief Information Security Officer (VCISO)](https://towerwall.com/virtual-security-officers/virtual-chief-information-security-officer-vciso/) - [Virtual Data Protection Officer (vDPO)](https://towerwall.com/virtual-security-officers/virtual-data-protection-officer-vdpo/) - [Virtual Chief Privacy Officer (vCPO)](https://towerwall.com/virtual-security-officers/virtual-chief-privacy-officer-vcpo/) - We Advise - - We Advise - One-size security solutions only lead to failure. - Industries - [Higher Education](https://towerwall.com/industries/higher-education/) - [Financial Services & Banking](https://towerwall.com/industries/financial-services-banking/) - [Healthcare](https://towerwall.com/industries/healthcare/) - [BioPharma & Bio-Therapeutics](https://towerwall.com/industries/biopharma-bio-therapeutics/) - [Retail](https://towerwall.com/industries/retail/) - [Government](https://towerwall.com/industries/government/) - [Catholic Diocese](https://towerwall.com/industries/catholic-diocese-cybersecurity/) - [Cannabis](https://towerwall.com/industries/cannabis/) - [Small Business](https://towerwall.com/industries/small-business/) - [Enterprise](https://towerwall.com/industries/enterprise/) - Trends & Threats - [Remote Workforce](https://towerwall.com/trends-threats/remote-workforce/) - [Vendor Questionnaire](https://towerwall.com/trends-threats/vendor-questionnaire/) - [HIPAA](https://towerwall.com/trends-threats/hipaa/) - [Ransomware](https://towerwall.com/trends-threats/ransomware/) - [GDPR](https://towerwall.com/trends-threats/gdpr/) - [Cloud Security](https://towerwall.com/trends-threats/cloud-security/) - [Phishing](https://towerwall.com/trends-threats/phishing/) - [Cybersecurity Insurance](https://towerwall.com/trends-threats/cybersecurity-insurance/) - [Resources](https://towerwall.com/resources/) - - Resources - Our latest insights, events, and tools to keep you safe. - - [Insights](https://towerwall.com/resources/?resources_category=MTU%3D&focusarea=0&industries=0&search=) - [Webinars](https://towerwall.com/resources/?resources_category=MTg%3D&focusarea=0&industries=0&search=) - [Whitepapers](https://towerwall.com/resources/?resources_category=MTY%3D&focusarea=0&industries=0&search=) - [View All](https://towerwall.com/resources/) - [Company](https://towerwall.com/company/) - - Our Company - We are the industry’s leading cybersecurity preparedness partner. - - [Who We Are](https://towerwall.com/company/) - [Our Team](https://towerwall.com/company/our-team/) - [Our Approach](https://towerwall.com/our-approach/) - [Our Values](https://towerwall.com/company/our-values/) - - [Awards & Recognition](https://towerwall.com/company/awards-recognition/) - [Certifications & Affiliations](https://towerwall.com/company/certifications-affiliations/) - [Community Involvement](https://towerwall.com/company/community-involvement/) - [Careers](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) Topics Yahoo, Varonis, NetworkWorld, CIA, behavior analytics, cannabis, cybersecurity, Enterprise, Data Breach # Protect your unstructured data with user behavior analytics [By Michelle Drolet](https://blog.towerwall.com/author/towerwall2020) [Read More](https://blog.towerwall.com/author/towerwall2020) 2 Minute Read April 04, 2017 ## User behavior analytics sniffs out anomalies in users' actions and alerts IT security teams of suspicious behavior The theft of unstructured data is extremely common. It can be very difficult to safeguard emails and files when a lot of people have access. Even the CIA is not immune, judging by the recent [exposure of its hacking tools via WikiLeaks](https://krebsonsecurity.com/2017/03/wikileaks-dumps-docs-on-cias-hacking-tools/). It’s ironic that the CIA’s hacking guides have been hacked, but it just goes to show how difficult it can be to prevent. Carelessly handled unstructured data is an easy target, and it can prove very valuable for hackers. Since unstructured data may not be monitored, attacks and successful exfiltrations often go unnoticed for long periods. For example, the [big data breach at Yahoo](http://www.networkworld.com/article/3123034/security/yahoo-reportedly-to-confirm-massive-data-breach.html) was only investigated after someone offered to sell millions of accounts on the black market. Many companies have no idea that they’ve been infiltrated. The global average time between compromise and breach detection is 146 days, according to [FireEye](https://www.fireeye.com/company/press-releases/2016/fireeye-releases-first-mandiant-mtrends-emea-report.html). Clearly, there’s a tangible need to cut that down, and user behavior analytics could be the answer. ### What is user behavior analytics? The idea behind user behavior analytics is to establish what normal activity looks like at an organization and to monitor for anything unusual. The focus is firmly on users, and suspicious behavior is flagged so that the IT security team can investigate. Many different actions might be flagged as worthy of further investigation, such as an employee accessing a system at 2 am, suddenly modifying thousands of files or trying to change administrative privileges. Being able to detect when users access sensitive data is the first step toward securing it properly. The beauty of user behavior analytics is that it’s about keeping a watchful eye on activities that IT security teams are worried about. That might be all activity pertaining to sensitive data, but it can also include mass failed log in attempts, email attachments sent to personal accounts and changes made outside of change control windows. ### People are the weakest link in cybersecurity A lot of time and money we put into information security is centered on software tools, but we know that [the weakest link in cybersecurity is employees](http://www.networkworld.com/article/3095486/security/cybersecurity-is-only-as-strong-as-your-weakest-linkyour-employees.html). It makes a lot of sense to take a closer look at people. Some security incidents can only be detected by analyzing people and their behavior with regard to valuable company data. A full 88 percent of end users say their job requires them to access and use proprietary information, according to [Varonis](https://info.varonis.com/hubfs/docs/research_reports/Varonis_Ponemon_2016_Report.pdf). Interestingly, 62 percent say they have access to company data they probably shouldn’t see. Getting into the network through an employee’s account can give a determined attacker access to a lot of unstructured data, some of which will arm them with the ammunition they need to burrow deeper or infiltrate new systems laterally. IT practitioners say insider negligence is more than twice as likely to cause compromise of insider accounts than anything else. It’s important that we look beyond perimeter defenses. Better firewalls, antivirus software or malware detection are not going to solve the problem, but user behavior analytics could make a real difference. ### Uncovering anomalies inside and out Because user behavior analytics sniffs out anomalies in user behavior, it can determine when a legitimate user’s credentials are being used by an external attacker. But the fact that it quickly identifies any deviation from the norm means it can spot the changes that signal insider theft or sabotage as well. Anything that doesn’t match the usual pattern of daily business sparks an alert. These kinds of alerts still require an experienced security officer to investigate and assess them, but they can drastically cut down on the time it takes to identify and confirm problems. As user behavior analytics technology improves, it’s likely to encompass more automation and go beyond data breach identification. All of the best security strategies include a blend of technologies and take a holistic view of the potential risks. The [cost of a data breach](http://www.networkworld.com/article/3135522/security/how-much-does-a-data-breach-actually-cost.html) is so high that it’s essential to take every action at your disposal that might mitigate the risk. Coupled with solid perimeter defenses, user behavior analytics is a powerful asset in the fight against data theft, and it represents an irresistible opportunity for companies to tighten up unstructured data protection. *This article was recently published in NetworkWorld >* *Image credit: Thinkstock* #### Protect your unstructured data with user behavior analytics Back to Top ## Related Insights ### [Always be Prepared: Monitor, Analyze and Test your Security](https://blog.towerwall.com/always-prepared-monitor-analyze-test-security) Yahoo, Varonis, NetworkWorld, CIA, behavior analytics, cannabis, cybersecurity, Enterprise, Data Breach ### [Successful Breakfast Event: From Zero to Data Governance Hero](https://blog.towerwall.com/successful-breakfast-event-data-governance-hero) Yahoo, Varonis, NetworkWorld, CIA, behavior analytics, cannabis, cybersecurity, Enterprise, Data Breach [View All Insights](https://blog.towerwall.com) × ## Talk with us now about: #### Your security needs. - ![Phone](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/phone-icon.svg "Phone") [Call 774.204.0700](tel:774.204.0700) - ![Mail](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/mail-icon.svg "Mail") [Email Us](mailto:info@towerwall.com) ### The front line of cybersecurity.™ For over 23 years, Towerwall, a woman-owned business, has helped scores of companies safeguard their data and leverage their investment in IT with advanced information security technology solutions and services. Our experience in all facets of information security coupled with serving in the CIO/CISO/ISO roles provides a unique first-hand understanding of the security challenges organizations face daily. ### Connect - - - - - [Career Opportunities](https://towerwall.com/company/careers/) - [Contact Us](https://towerwall.com/company/contact-us/) © Towerwall, Inc. and its licensees. All rights reserved [Privacy Policy](http://towerwall.com/privacy-policy/) Sitemap [Created by Howbridge](https://meethowbridge.com/) [![Towerwall](https://blog.towerwall.com/hubfs/raw_assets/public/Towerwall_July2021/images/footer-logo.svg "Towerwall")](https://towerwall.com/)