Why Traditional DLP Fail to Detect Most Insider Risks in Banking

Banking Sensitive Data Insider Threats Cases in Southeast Asia

Insider threats are a growing concern for banks in Southeast Asia. A well-known case occurred at OCBC, where former Assistant Vice President Au Jia Hao was sentenced to 10 weeks in prison for unauthorized access to 396 customer records between November 2022 and July 2023. This case illustrates that threats do not always come from external hackers—sometimes they arise from trusted employees with legitimate system access.

Misuse of customer data by internal staff can cause serious legal consequences, financial loss, and reputational damage to the bank. To prevent such risks, financial institutions must go beyond basic security tools. Strong system usage policies should clearly define responsibilities and boundaries. Technical restrictions, such as enforcing the principle of least privilege, can minimize unnecessary access. In addition, behavioral monitoring and auditing are essential to detect unusual activities early and provide evidence for compliance and investigations.

What Caused Banking Insider Data Leakage

Illegal access to sensitive data by employees, bulk data exports, and unauthorized operations remain the main insider risks in banking. One key issue is weak authority management. In many banks, employees are granted wide-ranging access rights, but when roles or positions change, these permissions are often not revoked in time. As a result, redundant access remains for months or even years, creating hidden vulnerabilities. This long-term accumulation of excessive permissions allows insiders to misuse data intentionally or accidentally, leading to potential breaches that threaten both customer trust and regulatory compliance.

How Traditional DLP Fails Insider Threats in Banking

Traditional Data Loss Prevention (DLP) systems often cannot fully address insider threats in banks. Key shortcomings include:

Permission Control Lag. Traditional Data Loss Prevention (DLP) systems often struggle to address insider threats in banks. One major problem is permission control lag. When an employee changes roles or leaves a department, their access rights are frequently not withdrawn promptly. Traditional DLP cannot dynamically detect these cases, meaning employees may still access sensitive customer data without proper authorization.

Difficulty Detecting Abnormal Behavior. Another challenge is detecting abnormal behavior. Traditional DLP relies on predefined rules, such as blocking specific keywords or file types. While this can prevent some leaks, it cannot easily distinguish between normal activity—like exporting a few reports—and abnormal actions, such as batch copying thousands of customer files. As a result, critical insider incidents may go unnoticed.

Lack of Behavioral Baselines. Traditional DLP lacks behavioral baselines. Without a model of normal daily operations for each employee, the system struggles to separate harmless actions from suspicious ones. This leads to a high rate of false positives (alerting on normal activity) and false negatives (missing actual threats), reducing trust in the system and delaying response to real breaches.

The following is deep insight about how CyberServal data loss prevention products with UEBA, data lineage, and dynamic decision-making helps banks stop insider threats, reduce false positives, and ensure compliance.

How CyberServal Solve Insider Threats for Banking

👉 For more detailed data loss prevention technologies, you can download our latest DLP whitepaper.

1. DDR Security Solutions for Permission Control Lag

UEBA (User Entity Behavior Analysis): DDR's UEBA technology can automatically generate user profiles of employees and departments within the bank, accurately locating and identifying high-risk employees. It identifies suspicious data leaks and swiftly targets suspicious users and devices by aggregating and analyzing user and entity activities, generating user behavior logs, risk events, and sensitivity labels.

Dynamic Decision Center: DDR supports a dynamic decision center with the ability to dynamically adjust user access permissions for sensitive files or block abnormal access, adjusting user and device permissions based on data leakage risk level, user behavior and device trust score, and established policies.

Organizational Structure Synchronization and Device Matching: DDR supports the foundation for data security operations by synchronizing organizational structure and user identity information, and automatically associating internal bank employees and devices. This also helps prevent and control risks for employees who perform abnormally or are about to leave.  

2. DDR Security Solutions for Difficulty Detecting Abnormal Behavior

Behavioral Baseline and Anomaly Detection: DDR's UEBA function module intelligently learns and analyzes user behavior models, establishes behavioral baselines, and monitors abnormal behavior in real time, effectively identifying potential leakage risks.

High-Risk Behavior Identification: DDR is able to identify behaviors such as large-scale file downloads beyond daily work needs, bulk transfer of sensitive data to personal cloud storage before leaving, systematic incremental extraction of data from internal resources, access to data unrelated to job responsibilities, and packaging of large volumes of files.

3. DDR Security Solutions for Lack of Behavioral Baselines

UEBA Building Behavioral Baselines: As mentioned above, DDR's UEBA technology is specifically designed to model user behavior and baselines to reduce false positives and false positives through continuous monitoring and learning.

Dynamic Risk Assessment: DDR can generate risk scores for departing employees, quickly identifying potential risk of offgoing data leakage.

Department Behavior Comparison: Support the department comparison function to evaluate whether the behavior of employees within the bank significantly deviates from the normal standards of the same department.

Reduced False Positive Rate: DDR claims to reduce false positive rates to less than 5% through context-aware protection, data lineage tracing, and AI-enhanced detection.

Linea AI's Semantic Understanding: Linea AI understands risks through collective intelligence without any rules, definitions, dictionaries, or policies, which allows it to detect more accurately and avoid false positives and false positives caused by traditional rules.

Case Preview: How to Identify and Handle Hidden Leakage Points in Advance

Here is a user case from CyberServal DLP company, During an internal review at a large bank, it was discovered that certain endpoints might be storing excessive amounts of sensitive customer information. Without proper management, such data could easily leak through unexpected means—for instance, casual note-taking or informal sharing channels. These risks are more common than many realize, and when exposed during audits or regulatory checks, the consequences can be severe.

👉 In our upcoming case study, we’ll explore how technology can address such risks at the source. Subscribe to receive more insights.