Diagrams and notesSame Taxonomy, Same Meaning?

In security, words drive purpose, and purpose drives the outcome. I have argued that before at the level of the whole program, where the choice between insider threat and insider risk decides what the program is able to do. This is the same problem one level down: a single alert, on a single desk, and three labels that look shared.

Security operations and insider risk functions often classify an alert with the same labels: false positive, true positive, benign positive. Because the labels are the same, the decisions behind them are easy to merge.

A false positive says the rule fired on activity that did not match what it was meant to detect. It is a finding about the rule, and it may come from the rule’s logic, its data, or its threshold, not necessarily from a wrong configuration. A true positive says the activity matched. It is a finding about the rule as well: on its own it does not show that the rule is effective overall, nor that the case must be escalated.

Benign positive is where the decisions separate. The activity happened and was expected. Expected, authorized, and harmless are three different properties, in security operations as in insider risk: an expected activity may not have been authorized for that purpose, and an authorized one may still cause harm.

So the case has its own path: the observed activity; the confirmation that the event occurred; the assessment of authorization and business context; the assessment of any violation or harm; and the decision to close or escalate, taken by whoever the operating model assigns. The evaluation of the rule runs beside that path and does not decide it.

Closing a case is not the same decision as accepting its residual risk. An analyst may close a case that contains a policy violation because the impact is tolerable; closing it does not give the analyst, or the function, the authority to accept the risk for the organization. That authority belongs to the owner the organization designates, within the risk appetite management sets.

Which leaves the question worth keeping: who has the authority to close a case that contains a violation, or to accept its residual risk? Very often it is the insider risk function itself, and rarely with anything in writing that says it may.

Worth asking at the next program review: was that authority ever given, or only assumed?