Insiders packing their bags with your data

Colin Estep opens with a hypothetical employee who gradually copies project files, guides and source code to personal cloud storage during a job search. The talk argues that data theft by departing staff is common, often not malicious, and that organizations need to spot it while the person is still employed rather than after they leave.

Drawing on data from more than 200 organizations over roughly nine months, covering about 58,000 people who left, Estep reports that a modest share moved data to personal apps and a smaller share violated corporate policy. Intellectual property and personal data made up most of what was taken, Google services were the dominant destination, and much of the movement happened weeks before notice was given. He walks through three signals: the direction of data movement, the nature of the data using DLP labels and policies, and its volume. Baselines are built at user, peer group and organization levels with anomaly models that flag spikes and first-time or rare behavior, and the talk covers how these models are deployed, tuned and triaged. Case studies show a confirmed departure, a likely leak and a benign case.

The takeaway for practitioners is to monitor a rolling window of roughly 50 days, combine direction, data sensitivity and volume rather than relying on simple thresholds, and invest in tuning so that alert review stays manageable.