[Verse 1] Alert arrives through DLP screens, UEBA flags the scene Tier One analyst scans the breach, determines what it means If credible anomaly shows, three contacts get the word HR Legal Security notified, synchronized and heard [Chorus] Three steps before they blink away Snapshot freeze and administrative stay Evidence captured forensically While Legal weighs authority Three steps before they blink away Lock it down without delay [Verse 2] Forensic snapshot grabs the trail, endpoint activity Account behavior frozen tight for investigation spree HR places them on leave with pay while probe begins Legal decides enforcement call, where jurisdiction wins [Chorus] Three steps before they blink away Snapshot freeze and administrative stay Evidence captured forensically While Legal weighs authority Three steps before they blink away Lock it down without delay [Bridge] RCMP Commercial Crime up north, FBI down south Criminal fraud gets reported when evidence bears mouth Recovery action cooperates with authorities aligned Three steps prevent destruction of the proof we need to find [Verse 3] Mandatory vacation time, coverage handoff starts Manager initiates the switch per documented arts Covering employee logs with their own credential key Variance triggers escalation to Finance Director's spree [Verse 4] Termination resignation needs synchronized revoke Access dies before notification, forensic workstation stroke Ninety days of access logs reviewed before they leave Exit interview acknowledgment, confidentiality weave [Final Chorus] Three steps before they blink away Snapshot freeze and administrative stay Evidence captured forensically While Legal weighs authority Three steps before they blink away Control mapping holds the sway [Outro] DLP triggers, coverage switches, access synchronization Three procedures safeguard assets through investigation
← When Sensitive Data Moves | Shield Against the Inside Threat →