Monitoring for insider risk and data loss

Supported editions for this feature: Chrome Enterprise Premium; Enterprise Standard and Enterprise Plus with Chrome Enterprise Core.  Compare your edition

Insider risk monitoring adds 4 reports to the security dashboard that summarize content transfer activity:

• Users with most sensitive content transfer on Chrome report
• Domains with most sensitive content transfer on Chrome report
• Domain types with most sensitive content transfer on Chrome report
• Sensitive content transfers on Chrome

These reports help you identify unusual activity and risky behavior. They report on activity using Chrome browser on Windows, Mac, Linux and the Chrome operating system. Other platforms are not supported at this time.

Note: The insider monitoring reports do not include activity in Incognito windows. For information about how to prevent users from opening new Incognito windows, read about the Incognito mode setting.

Configure insider risk and data loss monitoring

To enable insider risk and data loss monitoring, click the View details & enable link in the Monitor data leaks and insider risks box on the Google Admin console home page. Review the details about the security protections involved with insider risk and data loss monitoring, then click Enable. Any manually modified connector and event reporting settings are not enabled unless you opt in using the checkbox to override all settings.

If connectors are configured for a provider other than Chrome Enterprise Premium or None, the override checkbox does not override those connectors settings. In this case, there are 2 ways to override the connection settings:

• Option 1—Go to the Chrome Enterprise Connector settings and change it to None. Try again to enable the Monitor data leaks and insider risk on the Admin console home page.
• Option 2—Go to the Chrome Enterprise Connector settings and manually set Chrome Enterprise connector policies for Chrome Enterprise Premium.

Enabling insider risk and data loss monitoring enables the following enhanced Chrome security protections for users:

• Chrome security event logging records user activity in Chrome that may be relevant from a security perspective, such as Content unscanned, Unsafe site visit, or Password reuse.
• Chrome data insights scanning and reporting initiates review of uploaded, downloaded, and printed content to check for sensitive data.
• Chrome Enterprise connectors perform the data review for up to 50 MB of content.
  • Upload content analysis scans uploaded files for sensitive data and malware.
  • Download content analysis scans downloaded files for sensitive data and malware.
  • Bulk text content analysis scans large blocks of pasted text for sensitive data when you define a Data Loss Prevention rule.
  • Print content analysis scans printed text for sensitive data.
  • Real time URL check scans accessed URLs in real time to protect users against dangerous sites, based on the Safe Browsing Protection Level setting.
  • You can expand sensitive data analysis by creating Data Loss Prevention rules.

These protections are enabled for the entire organization, that is, they are enabled at the root organizational level.

You can customize insider risk and data loss monitoring by changing which organizational units it applies to or updating the Chrome connectors configuration For example, you can limit which security events get logged or prevent certain files from being sent for analysis or downloaded.

Chrome security event logging

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserSettings.

3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
4. Go to Browser reporting.
5. Next to Event reporting, make sure that Enable event reporting is checked.
6. (Optional) Configure additional settings. Choose the reported event types that you need based on what type of content you want to send for analysis. For details, go to Chrome audit log.
   • Default event types—Chrome threat and data protection events include malware transfer, password reuse, and unsafe site visits.
7. Click Save.

Chrome data insights and reporting

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlData protection.
3. For Data protection insights setting, ensure that Data protection insight scanning and report is On.

If you turn off the Data protection insight scanning and report, it pauses production of the new insider risk monitoring reports. When you turn the setting On, the reports will be available in a day or 2.

Chrome Enterprise connectors

For details about configuring how Chrome connectors review content, see Set Chrome Enterprise connector policies for Chrome Enterprise Premium .

Related topics

• Protect Chrome users with Chrome Enterprise Premium
• Use Chrome Enterprise Premium threat and data protection to integrate DLP with Chrome