The movers/leavers process is a commonly under-hardened insider threat flashpoint. When an employee resigns, gets terminated or moves to a new role, a window of elevated risk opens.

Recent security research shows that nearly 30% of voluntarily departing insiders resigned without notice and the vast majority exfiltrated data before leaving. In 28% of cases, exfiltration continued even after employment ended through a variety of persistence methods.

The good news? We already have the building blocks and data to address these threats - they just need to be wired together with a clear understanding of what you're defending against.

In this session, Tatu will demonstrate an array of concrete, data-driven technical hardening measures using Purview, Entra ID and Defender capabilities in synergy that help close the gaps that matter most during workforce transitions. We will walk through measures against risks such as pre- and post-employment data exfiltration, privilege creep and systems sabotage, as well as insider risk investigation and forensics tips.

We will also cover some capability gaps in the current Microsoft technology stack for which further development is likely necessary.

You will take home a set of technical patterns and practices that you can start implementing immediately. This session is well-suited for security architects, insider risk and data security responsibles and IT pros looking to close the gaps that open when people transition between roles or leave the organization.

You will learn:

• Understand the key insider threat patterns and risks that open during worksforce transitions
• Which technical measures and patterns using Microsoft technologies can help counter the most common risks
• Understand capability gaps that still aren't fully addressed out-of-the-box