Thursday, June 11, 2015

Every organization should have honeypot documents

I was working on a slide-deck about the Office Graph and Delve and got thinking about the public and private signals in the graph.

In the graph a person viewing a document is a private signal as no one else will know that the person viewed that particular document. But even though it’s a private signal in the office graph, it is still not 100% private as it’s stored as a view count on the document itself via SharePoint search, making it anonymous information available to everyone with read access to the document.

And this realization triggered a whack idea about honeypot documents. Honeypot servers have been deployed for a long time to see how people are trying to break into computer networks, or bait them into hacking the server. What if you could use the same tactics to catch trends in a company?

Say you have an HR document outlining the procedure on how you resign from your job, or how to get a new mobile phone? By monitoring the view counts of those documents over time you can easily use PowerBI or Excel to see if something suspicious is happening. In the image below you see that the month of June had an unusual high number of views, and catching this as it starts to trend you might be able to take action before everyone leaves the company.


Or in the case of mobile phones, effectuate a purchase stop when Apple release a new iPhone model.
Other more realistic examples might be to monitor that certain policy documents actually are consumed regularly, or that the CEO’s blog posts are not written in vain.

imageNot only do SharePoint Search log view counts, but unique visitors is also logged. There’s a whole range of properties for different time intervals you can use.

As of now there is no out of the box way to catch these trends, but with the right skills you could set up scheduled searches which logs the data you can report on.
Once the trap is set it’s a matter of waiting for that intelligent alert to start chiming so you can take the proper action!

Or like Winnie the Pooh said: “Some people care too much. I think it's called love.”