- Session Monitoring (SM) – Advanced screen capturing, keystroke logging, and mouse-click recording of a privileged session for the duration of access. Results are encrypted and sent to the BeyondInsight IT Risk Management Console for later searching, reporting, forensics, download, and DVR-style playback.
- File Integrity Monitoring (FIM) – The monitoring, logging, and even denial of access to the file system based on users, to ensure privileged access does not alter the file system in an undesirable way. FIM is a persistent function within PBW and operates even when no user is interactively logged in. The results are also sent to the BeyondInsight IT Risk Management Platform console for alerting and reporting.
- Event Log Monitoring (ELM) – As users interact with a host, critical functions like services and drivers generally write to the Windows Event Log. PBW contains pattern-based Windows Event Log Monitoring and reporting to track all types of access (privileged and non-privileged). As a privileged user, it is possible to create local users or even disable security tools if PBW rules were written to do so. ELM allows for the logging of these activities and provides a deeper view into system interaction.
- Risk Compliance – The decision to elevate an application via rule can have some shortcomings if the application possesses an unnecessary risk based on vulnerabilities. Risk Compliance is a part of Vulnerability-Based Application Management (VBAM), which allows rules to be created for privileged access based on an application’s published vulnerabilities. This allows auditing of applications based on their risk, regulatory compliance violations, and permissions all through BeyondInsight to determine the health of applications when given administrative privileges. It completes the auditing perspective because you not only can track what privileged users do with complete context, but also audit the applications themselves to round out the documentation trail.
PowerBroker for Windows provides much more than privileged identity management and application control alone. The auditing capabilities in PBW and BeyondInsight allow for the complete logging of privileged user activity as required by security best practices and regulatory compliance initiatives. In addition, these features can replace many standalone tools for file integrity monitoring and Windows Event Log monitoring – all the way down to the desktop or server. They help support the auditing of least-privilege access and allow your organization to realize the cost and operational benefits of least-privilege access. For more information, check out:
- White paper: “Powerbroker for Windows: Risk Compliance”
- Short videos of the Windows privilege management features referenced in this post
Morey J. Haber, Chief Security Officer at BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored three books: Privileged Attack Vectors, Asset Attack Vectors, and Identity Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.