Insider Threat Awareness and Prevention with MS Purview

Intro to Insider Threat Awareness

Organizations today face many security challenges, with insider risk being a real concern that can significantly impact their operations. Insider risk involves threats from within the organization, such as employees, contractors, or partners, who have access to sensitive information and systems. These risks can lead to accidental data leaks or deliberate sabotage, affecting the organization’s financial health, reputation, and customer trust.

To address these challenges, organizations must implement preventative security measures. Microsoft Purview offers a comprehensive suite of tools designed to help businesses manage and mitigate insider risks effectively. Using Microsoft Purview, organizations can increase their visibility into internal operations, identify potential risks before they escalate, and enforce policies to protect sensitive data.

This proactive approach is vital for securing an organization’s data against the evolving landscape of insider threats. Throughout this blog, we will look into how insider risks can affect your organization and explore the capabilities of Microsoft Purview in mitigating these risks.

Types of Insider Risk

Insider risks can manifest in various forms within an organization, each presenting unique challenges and potential damages. Understanding these types is important for developing your mitigation strategies.

Here’s an in-depth look at the different types of insider risk:

Negligent Insiders: The most common form of insider threat comes from well-meaning employees or contractors who accidentally cause security breaches. This can occur through simple mistakes, such as sending sensitive information to the wrong recipient, misplacing devices containing confidential data, or falling victim to phishing scams. These incidents, while unintentional, can lead to significant data loss and compromise organizational security.

Malicious Insiders: Unlike negligent insiders, malicious insiders intentionally harm the organization by stealing, sabotaging, or leaking data. This could be for personal gain, such as selling trade secrets or personal data on the dark web, or out of spite towards the organization. Identifying malicious insiders can be challenging, as they often have legitimate access and understanding of the systems they exploit.

Insider Collusion: Sometimes, insiders may collaborate with external parties to carry out their malicious activities. This type of insider risk is particularly dangerous because it combines internal access with external malicious intent, amplifying the potential for damage. Insider collusion can be part of corporate espionage, fraud schemes, or other criminal activities.

Third-party Vendors: Organizations often grant external vendors and contractors access to their systems and data, which can inadvertently introduce risks. These third-party insiders might not have the same level of security awareness or controls as the organization, making them a weak link in the security chain. Breaches stemming from third-party vendors can expose sensitive information and create entry points for further attacks.

Disgruntled Employees: Employees who are dissatisfied or in conflict with the organization pose a significant insider threat. Their grievances might motivate them to retaliate by leaking sensitive information, corrupting data, or disrupting operations. Monitoring for signs of disgruntlement and addressing workplace issues proactively can help mitigate this risk.

Addressing these various types of insider risk requires a comprehensive approach that includes both technological solutions, like Microsoft Purview, and organizational strategies, such as fostering a culture of security awareness and implementing strict access controls.

Impacts of Insider Risk

Insider threats can create issues across several critical areas:

Financial Impact: The financial repercussions of insider threats are perhaps the most obviously quantifiable. Insider incidents can cost organizations millions of dollars, with the average cost of a single incident reaching up to $15.38 million.

These costs stem from direct losses, such as theft of intellectual property or funds, as well as indirect costs, including legal fees, investigation expenses, and remediation efforts to prevent future breaches. The financial strain can be particularly hard for smaller organizations, who might not have the same resources as larger firms to absorb these costs.

Reputational Damage: Beyond the direct financial loss, the reputational damage inflicted by insider threats can have long-lasting effects. When sensitive customer data is exposed, or the organization is seen as vulnerable, trust erodes.

This erosion of trust can lead to a loss of business, as customers and partners may choose to take their business elsewhere, wary of the organization’s ability to safeguard their information. Rebuilding this trust is a long and challenging process that requires transparent communication and demonstrable improvements in security posture.

Operational Disruption: Insider threats can cause significant operational disruptions. Malicious insiders, for instance, may sabotage systems, delete critical data, or introduce malware that hampers business operations.

Even incidents stemming from negligence can result in system outages or loss of access to critical data, leading to downtime and reduced productivity. The time and resources required to restore operations can further exacerbate the financial and reputational impact on the organization.

Health and Safety Risks: In certain industries, such as healthcare, energy, or manufacturing, insider threats can also pose direct risks to physical health and safety. Malicious actions or negligence can lead to system failures that impact patient care, disrupt utilities, or cause accidents.

These incidents not only have immediate safety implications but can also lead to regulatory penalties and further damage the organization’s reputation.

Compromised Intellectual Property: The theft or unauthorized disclosure of intellectual property (IP) is a critical concern for many organizations. Insiders with access to proprietary information, trade secrets, or innovative technologies can inflict significant competitive harm by leaking this information to competitors or using it to start their ventures.

Mitigating these risks requires an approach that includes technical solutions, such as access controls and monitoring systems, alongside organizational measures like employee training and a culture of security awareness. It’s essential for organizations to recognize the multifaceted nature of insider threats and implement layered defense strategies to protect against these potential consequences.

The Complexities of Insider Threat Prevention

Insider threat prevention presents challenges ranging from detection difficulties to the complexity of maintaining a balance between security and privacy.

Here are some of the key challenges in managing insider risks:

Detection and Identification: Detecting and identifying insider threats is challenging. Insiders, by definition, have legitimate access to the organization’s resources, making it difficult to distinguish between normal and potentially harmful activities.

This is where tools like Microsoft Purview come into play. Microsoft Purview offers advanced insider risk management capabilities, enabling organizations to detect, investigate, and act on malicious and inadvertent activities in their digital environment. Using such tools, businesses can more effectively spot unusual behavior patterns that may indicate insider threats.

Diverse Motivations and Behaviors: Insiders can be motivated by a variety of factors, including financial gain, revenge, ideology, or coercion. This diversity makes it challenging to predict and detect insider threats based on behavior alone. Additionally, not all insider threats are intentional; many result from negligence or lack of awareness, adding another layer of complexity to risk management efforts.

Access Management: Managing access to sensitive information and critical systems is a constant challenge. Organizations must ensure that employees have the access they need to perform their jobs without exposing the organization to undue risk. This requires robust access control policies, regular audits, and updates to access rights based on changes in job roles or employment status.

Balancing Security with Privacy: Organizations must navigate the delicate balance between monitoring for security purposes and respecting the privacy of their employees. Excessive monitoring can erode trust and negatively impact company culture, while insufficient monitoring can leave the organization vulnerable to insider threats.

Evolving Threat Landscape: The methods and techniques used by malicious insiders are constantly evolving, as are the tools and technologies available to organizations for managing insider risks. Keeping pace with these changes requires ongoing investment in security technologies, training, and awareness programs.

Cultural and Organizational Barriers: Building a culture of security awareness and encouraging employees to report suspicious activities without fear of reprisal are significant challenges. In some cases, organizational silos and lack of communication can hinder effective insider threat management.

Legal and Regulatory Compliance: Organizations must comply with a range of legal and regulatory requirements related to data protection and privacy. Managing insider risks without violating these requirements demands a thorough understanding of the legal landscape and careful design of security and monitoring programs.

Addressing these challenges requires an approach that combines technology, policy, and culture. Organizations must invest in insider threat awareness. Detection and response technologies like Microsoft Purview help establish clear policies and procedures and foster a culture of security awareness and responsibility across all levels of the organization. Additionally, regular training and education programs can help mitigate the risks posed by negligent or unintentional insider actions.

The Limitations of Traditional Security Measures

Traditional security measures, while foundational to any cybersecurity strategy, face inherent limitations when it comes to addressing insider threats effectively.

These limitations include:

Focus on External Threats: Traditional security solutions are primarily designed to defend against external threats. They monitor and block unauthorized access attempts, malware, and other external attacks. However, insider threats originate from within the organization, from individuals who already have authorized access. This makes the malicious or negligent activities of insiders harder to detect with systems that are looking outward for danger.

Static Security Policies: Many traditional security measures rely on static policies and rules that do not adapt to the changing behaviors of users within an organization. Insider threats, by contrast, often involve subtle changes in behavior or misuse of access privileges, which static rules are ill-equipped to identify and respond to dynamically.

Lack of Behavioral Analysis: Traditional security tools may lack sophisticated behavioral analysis capabilities that are necessary to identify the nuanced and evolving patterns of insider threats. Without the ability to analyze and understand normal user behavior and detect anomalies, these tools can miss early warning signs of insider threats.

Insufficient Contextual Information: Identifying potential insider threats requires a deep understanding of the context in which access requests and data interactions occur. Traditional security measures may not integrate contextual information—such as the time of access, the sensitivity of accessed data, or the typical behavior patterns of a user—making it difficult to assess the risk associated with specific actions.

Privacy Concerns: Implementing measures to monitor and mitigate insider threats can raise privacy concerns among employees. Traditional security tools that are overly intrusive can lead to a lack of trust in the organization, potentially harming company culture without necessarily providing effective insider threat detection.

Overreliance on Perimeter Security: Traditional security approaches often emphasize perimeter defense, focusing on keeping attackers out. However, insider threats already bypass this perimeter due to their legitimate access. This overreliance can lead organizations to underinvest in measures that monitor and control internal activities and access to sensitive data.

To overcome these limitations, organizations are increasingly turning to advanced security solutions like Microsoft Purview, which offers insider risk management features. These solutions incorporate behavioral analytics, machine learning, and data science techniques to detect unusual activities that could indicate insider threats. They provide a more nuanced, dynamic, and effective approach to insider threat detection and management, addressing the gaps left by traditional security measures. If you need a Microsoft Purview Consultant, Levacloud have you covered.

Overview of Microsoft Purview and Insider Risk Management

MS Purview is a comprehensive tool designed to help you tackle the challenges of compliance, risk management, and security. Its integrated approach provides a robust framework to protect against insider threats, ensuring data protection and compliance with regulatory requirements.

Key components of Microsoft Purview relevant to insider threat awareness and management include:

Microsoft Purview Insider Risk Management: This component is specifically tailored to help organizations detect, investigate, and act on malicious and unintentional insider threats. It uses machine learning and artificial intelligence to analyze various signals across Microsoft 365 and other data sources, identifying activities that might indicate a risk. By offering detailed insights and the ability to customize indicators based on specific organizational needs, Insider Risk Management enables proactive mitigation of potential insider threats.

MS Purview Information Protection: This feature focuses on ensuring that sensitive information is identified, classified, and protected, regardless of where it resides or travels. It provides organizations with the tools to apply labels and encryption to documents and emails, control access, and track user activities on sensitive information. This helps in preventing data leaks or misuse by insiders, ensuring that data is accessed and used in accordance with organizational policies and compliance requirements.

MS Purview Compliance Manager: Compliance Manager helps organizations manage their compliance posture by providing a set of tools to assess and manage compliance risks. It offers a centralized dashboard to track compliance scores, provides detailed insights into regulatory requirements, and suggests actions to improve compliance. This is crucial in managing insider risks, as it ensures that data handling practices are in line with legal and regulatory standards, reducing the risk of data breaches and insider threats.

MS Purview Data Loss Prevention (DLP): DLP policies in MS Purview help prevent the accidental sharing of sensitive information outside the organization. By identifying, monitoring, and automatically protecting sensitive items across Microsoft 365 services, DLP plays a key role in mitigating insider risks related to data leaks and misuse.

By leveraging these key components of Microsoft Purview, organizations can build a strategy to manage insider risks effectively. This includes detecting risky behaviors, protecting sensitive information, ensuring compliance with regulations, and preventing data loss.

MS Purview’s Key Features

Insider Risk Management

Microsoft Purview Insider Risk Management harnesses the power of advanced analytics and machine learning to proactively identify and manage potential insider threats within an organization. This solution is designed to analyze a broad array of signals and data sources, including user activity, communication patterns, and file interactions, across various platforms within the Microsoft ecosystem, such as Microsoft 365, Windows, and Azure.

The core of its functionality lies in its ability to sift through vast quantities of data to spot activities that deviate from established patterns or indicate risky behavior. For instance, it can identify unusual file access patterns, such as accessing, downloading, or sharing sensitive information at odd hours, which could suggest an attempt to exfiltrate data. Similarly, it can detect when a user is attempting to bypass security controls or is engaging in other actions that could pose a risk to the organization’s data security.

What sets Microsoft Purview Insider Risk Management apart is its use of machine learning algorithms that continuously learn and adapt based on the evolving behavior patterns of users within the organization. This adaptive learning capability enables the system to refine its threat detection over time, reducing false positives and enhancing its ability to pinpoint genuine risks.

Upon detecting potential insider threats, Microsoft Purview Insider Risk Management provides detailed alerts to security administrators, complete with contextual information about the suspicious activity. This not only includes specifics about the action taken but also contextual data that helps in understanding the potential impact and intent behind the actions. Security teams can then investigate these alerts further using the solution’s investigation tools, which offer case management features to track the status of investigations, gather evidence, and collaborate with other team members.

Moreover, MS Purview Insider Risk Management is designed with privacy in mind. It includes built-in privacy controls to help organizations balance security needs with the privacy expectations of their employees. For example, it anonymizes user data in its reporting and alerts to ensure that privacy considerations are respected during the initial stages of an investigation.

Microsoft Purview Insider Risk Management provides a sophisticated, comprehensive approach to insider threat prevention, helping organizations protect their critical assets and data against both malicious and unintentional insider risks. It is, however, essential that Purview is implemented appropriately for your organization to achieve that protection.

Preventing Human-Operated Ransomware Attacks

Human-operated ransomware attacks are conducted manually by cybercriminals who use insider access to deploy ransomware. Effective insider risk management can help prevent and detect these attacks by monitoring user behavior for signs of unusual activity.

Insider risk management, including tools like Microsoft Purview, allows organizations to spot early warnings of potential ransomware activity. This includes unexpected access to sensitive data, sudden changes in data handling, or unauthorized data transfers. By setting alerts for such activities, security teams can respond quickly to mitigate threats.

One key aspect of insider risk management is controlling access to data and systems. Limiting access based on user roles can reduce the chances of ransomware spreading. Regularly reviewing and adjusting access rights based on risk assessments can further strengthen defenses.

Training employees to recognize phishing and other tactics used in ransomware attacks is also vital. A well-informed workforce can act as an early detection system by reporting suspicious behavior.

In case of an attack, insider risk management tools provide detailed logs and investigation capabilities. This helps in quickly understanding how the attack happened and how to recover from it. Tools like Microsoft Purview help in monitoring, detecting, and responding to insider threats, thus protecting organizations from these targeted attacks.

Information Protection

Microsoft Purview Information Protection is a useful part of Microsoft’s suite of security and compliance tools, designed to help organizations classify, label, and protect their sensitive information across a wide range of devices, applications, and services. This capability is helpful in addressing the challenges of insider risks, as it provides a framework for ensuring that sensitive data is handled appropriately, regardless of where it is stored or how it is accessed.

Classifying and Labeling Data: The foundation of Microsoft Purview Information Protection lies in its ability to classify data based on its sensitivity. Organizations can define classification labels that correspond to different levels of sensitivity (e.g., public, general, confidential, highly confidential) and apply these labels automatically based on the content of the documents or manually by users. This process is powered by advanced machine learning algorithms that scan content for sensitive information types, such as personal identification numbers, financial records, or confidential project details.

Protecting Sensitive Information: Once data is classified and labeled, Microsoft Purview Information Protection applies protection measures according to the organization’s policies. This can include encryption, access restrictions, and visual markings. Encryption ensures that data is unreadable to unauthorized users, while access restrictions limit who can view or edit the information based on their role or clearance level. Visual markings, such as watermarks, further deter unauthorized sharing by making the sensitivity of the information explicitly clear.

Benefits for Insider Risk Management: The classification, labeling, and protection capabilities of Microsoft Purview Information Protection are directly beneficial for insider threat prevention in several ways:

Preventing Accidental Exposure: By automatically classifying and encrypting sensitive information, the solution helps prevent scenarios where employees might inadvertently share sensitive data with unauthorized parties. This reduces the risk of data leaks due to negligence.

Detecting and Stopping Malicious Activities: The solution’s ability to track access and use of classified information enables organizations to detect unusual patterns of behavior that could indicate malicious intent. For example, if an employee attempts to access or share a large volume of sensitive documents without authorization, security teams can be alerted and take immediate action.

Compliance and Regulatory Adherence: Many insider risk incidents involve non-compliance with regulatory requirements for handling sensitive data. Microsoft Purview Information Protection helps organizations maintain compliance by ensuring that data protection measures are consistently applied across all information, in line with legal and regulatory standards.

Educating Employees: The visibility of classification labels helps raise awareness among employees about the sensitivity of the information they handle, fostering a culture of security and responsibility. This education is key to preventing both accidental and intentional insider risks.

MS Purview Information Protection plays a critical role in insider threat prevention by helping you in classifying, labeling, and protecting sensitive information.

Compliance Management with MS Purview

Microsoft Purview Compliance Manager within the suite is designed to assist organizations in managing their compliance posture across various regulatory standards and internal policies. It plays a crucial role in mitigating insider risks by ensuring that data handling practices adhere to compliance requirements, thereby reducing the potential for data breaches and misuse of sensitive information.

Facilitating Compliance with Regulations: Compliance Manager provides a centralized dashboard that offers insights into the organization’s compliance status with applicable laws, regulations, and standards. It simplifies the complex by breaking down requirements into actionable tasks, enabling organizations to assess their current compliance levels and identify areas that require attention.

Assessing and Managing Risks: One of the key features of Compliance Manager is its ability to help organizations assess and manage risks associated with non-compliance and insider threats. It offers risk assessment tools that allow organizations to evaluate their controls against compliance standards and identify gaps that could pose risks. This proactive approach to risk management is essential in insider threat prevention, as it ensures that vulnerabilities are addressed before they can be exploited.

Customizable Compliance Controls: Compliance Manager allows organizations to customize compliance controls and policies to suit their specific needs and risk profiles. This customization capability is particularly beneficial for managing insider risks, as it enables organizations to implement controls that are specifically designed to monitor and mitigate the unique risks posed by insiders, such as unauthorized access to sensitive data or improper data handling.

Documentation and Reporting: Maintaining detailed documentation and reports is an important part of compliance and risk management. Compliance Manager facilitates this by enabling organizations to generate reports that document their compliance efforts, actions taken to mitigate risks, and the current compliance status. This documentation is invaluable not only for internal audit and review purposes but also for demonstrating compliance to regulators and stakeholders, thereby reinforcing the organization’s commitment to data protection and risk management.

Benefit for Insider Risk Management: By ensuring that organizations have a robust compliance and risk management framework in place, Microsoft Purview Compliance Manager directly contributes to insider threat prevention. It helps organizations to establish and enforce policies that prevent insider threats, detect potential breaches of compliance that could indicate insider activity, and respond effectively to incidents when they occur. Leveraging the comprehensive capabilities of Compliance Manager, businesses can enhance their security posture by integrating compliance and risk management into their overall insider risk strategy.

In the context of insider risk management, Microsoft Purview Compliance Manager serves as a critical tool for businesses aiming to safeguard their sensitive data and intellectual property. By providing a clear framework for compliance and risk assessment, it empowers organizations to proactively identify and address vulnerabilities. This proactive stance is crucial when the cost of non-compliance and the impact of insider threats can be substantial.

Moreover, the ability to customize compliance controls and policies ensures that businesses can tailor their risk management strategies to reflect their unique operational environments and threat landscapes. This customization is key to developing an effective insider risk management program that can adapt to evolving threats and compliance requirements.

By integrating Compliance Manager into their security strategies, businesses can not only mitigate insider risks but also demonstrate their commitment to maintaining a secure and compliant operational environment.

Audit and Investigation Tools

MS Purview’s audit and investigation tools are also needed in the fight against insider risks, offering a suite designed to monitor, analyze, and respond to potential threats from within an organization. These tools provide a framework for tracking user activities and data interactions, which is vital for identifying unusual patterns or behaviors that may signal an insider threat. With advanced logging capabilities, Purview captures detailed information on access to sensitive data, modifications, and user transactions, creating a transparent record needed in forensic investigations.

The investigation tools within Microsoft Purview are specifically tailored to streamline the process of looking into incidents, enabling security teams to dissect the sequence of events leading up to a potential breach or misuse of data. This is critical for understanding the scope of an incident, assessing the impact, and implementing measures to prevent future occurrences. These tools also facilitate the correlation of disparate data points, helping with insider threat awareness which might otherwise go unnoticed.

Beyond detection and investigation, MS Purview’s audit tools play a crucial role in compliance and governance. By maintaining an audit trail, organizations can demonstrate adherence to regulatory requirements and internal policies. This documentation is invaluable not only for compliance purposes but also for enhancing accountability and transparency within the organization.

The flexibility to customize alerts and integrate with other security systems means that Purview can adapt to the needs of each organization, providing a tailored approach to insider risk management. This adaptability ensures that businesses can focus on specific risk indicators relevant to their operations, enhancing the efficiency and effectiveness of their security measures.

Implementing MS Purview: Best Practices

Deploying Microsoft Purview within an organization involves a strategic approach to ensure its capabilities are fully leveraged for compliance, governance, risk management, and security purposes.

Below is a guide on best practices for implementing Microsoft Purview effectively:

Define Your Compliance and Security Goals: Begin by clearly identifying your organization’s compliance requirements and security objectives. Understand the regulatory standards you need to adhere to and assess the internal risks, including insider threats. This initial step will help tailor the deployment of Microsoft Purview to meet specific organizational needs.

Conduct a Data Inventory and Classification: Perform a comprehensive inventory of the data stored across your organization’s digital environments. Classify this data based on sensitivity, regulatory requirements, and business importance. Microsoft Purview’s data classification tools can assist in automating this process, making it easier to apply governance and protection policies accurately.

Establish Governance and Compliance Frameworks: Utilize Microsoft Purview to create governance and compliance frameworks that align with your organization’s policies and regulatory requirements. This includes setting up data loss prevention (DLP) policies, information barriers, and retention policies to control how data is accessed, shared, and managed.

Customize Policies and Controls: Tailor the compliance controls and policies within Microsoft Purview to fit your organization’s specific risk profile and security needs. Consider customizing access controls, implementing strict data handling policies for sensitive information, and setting up alerts for unusual activities indicative of insider threats.

Train Your Team: Ensure that your IT, security, and compliance teams are well-versed in using Microsoft Purview, or opt for a Microsoft Purview Consultant to get you started. Training should cover how to monitor compliance statuses, conduct audits and investigations, and respond to incidents. Additionally, educating the broader workforce about data protection policies and practices is crucial for minimizing insider risks.

Integrate with Existing Systems: Use Purview’s integration capabilities to connect with other security and compliance solutions within your organization. This holistic approach ensures that insights and alerts can be centrally managed, enhancing your overall security posture.

Monitor and Review Regularly: Continuous monitoring is key to identifying and mitigating risks promptly. Use MS Purview’s dashboards and reports to keep a close eye on your organization’s compliance status and security landscape. Regularly review policies and controls to adjust to new threats, regulatory changes, and business needs.

Leverage Audit and Investigation Tools: Make full use of Purview’s audit and investigation tools to detect, investigate, and respond to insider threats and compliance issues. Establish protocols for conducting investigations and utilize the detailed logging and reporting features to support forensic analysis and compliance audits.

Document and Report Compliance: Maintain detailed records of your compliance efforts, policies implemented, and incidents managed using Microsoft Purview. These documents are invaluable for demonstrating compliance to regulators, auditors, and stakeholders, reinforcing the organization’s commitment to data protection and risk management.

Foster a Culture of Compliance and Security Awareness: Promote a culture where every employee understands their role in maintaining compliance and protecting sensitive information. Encourage proactive reporting of suspicious activities and reinforce the importance of adhering to established policies and procedures.

Implementing Microsoft Purview following these best practices will enable organizations to enhance their compliance posture, mitigate insider risks, and maintain a robust security framework tailored to their unique operational needs.

Conclusion

Managing insider risks is a complex but essential task for organizations aiming to protect their sensitive data, maintain customer trust, and ensure compliance with regulatory standards. Purview offers a comprehensive suite of tools that address the broad nature of insider threats, providing organizations with the capabilities needed to detect, investigate, and mitigate potential risks effectively.

From leveraging advanced analytics and machine learning for insider risk management to implementing robust information protection and compliance frameworks, Purview equips businesses with the tools necessary to build a secure and compliant operational environment.

Implementing MS Purview following best practices, such as defining clear security goals, conducting thorough data classification, customizing policies, and fostering a culture of security awareness, allows organizations to enhance their security posture against insider threats. It’s often necessary to reach out to a Microsoft Purview Consultant to assist with your Purview installation and set-up due to its complex nature.

Levacloud specializes in Microsoft Purview Insider Risk Management, offering expert guidance to help organizations manage insider risks and comply with regulations. If you are looking for a Microsoft Purview Consultant, their services include implementing, optimizing, and managing Purview to enhance your data protection and risk management efforts. With Levacloud’s expert support, you can effectively utilize Purview’s tools to secure your organization’s sensitive information and systems.