NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Demos
    • Glossary
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

I Spy with My Little Eye – Using Threat Analytics as Your Secret Weapon

September 27, 2018

  • Blog
  • Archive

blog-i-spy-with-my-little-eye.jpg

In a previous blog post, I outlined the threat of attack by exploitation of weak links— attack vectors innocuous enough to appear on the radar, but exploitable enough to move an attacker one step further into your organization.

Using lateral movement to penetrate an organization is like playing a board game. You don’t leap across the board in one swoop. Instead, you move square by square (hopefully without your opponent noticing you) until you can strike.

So, when it comes to defending your organization against threats, you are not playing one game board against one opponent. You are playing against multiple opponents on hundreds or thousands of game boards (your systems) simultaneously. So just how do you keep track of these moves? And, how do you distinguish a valid users’ activity from an attacker’s?

Anomaly Detection and Threat Analytics

Logging user activity is a best practice for most organizations, but often you get so much information back that it is very difficult to manually identify patterns of behavior in audit trails. This is where threat analytics comes to the rescue. Self-learning algorithms learn what activity standard behavior is made of (this is also known as baselining.) Whenever something changes, it can generate an event to alert you to the fact that a user has done something different.

So, we can just implement a baselining tool and we’re covered, right?

Not quite. Patterns of behavior can be quite complex, and often it’s not a single anomaly that stands out— it’s a collection of anomalies threaded together. I’ll give an example:

Let’s say I have a rule that highlights when a user logs onto a new server; this rule may well be firing off hundreds of times a day as administrators build up and tear down virtualized environments. We’ll simply give this anomalous behavior a score of “1”. Now we look at what time of day the user is making the access request— we’ll score all those events as “1”. What about servers that have unpatched vulnerabilities? I think that access to these systems are a little riskier, so we’ll give these events a score of “1”.

What you will see is that by looking at activity from multiple angles and incrementing up the activities score based on different factors, we can start to see events that “pop out”. To give another example:

A user tried to access a vulnerable server they had not used before, at a time they do not normally work. The access request came over a VPN from a foreign location, and the user tried to jump to another host using the MSTSC command. These factors combined to elevate the event threat level enough that it stood out and received immediate attention.

BeyondTrust’s advanced threat analytics solution helps pinpoint breaches that many other products miss. It processes and analyses data from network devices such as Palo Alto, as well as BeyondTrust’s full range of Privilege Access Management and Vulnerability management solutions, including:

  • PowerBroker Password Safe – Privileged password and session management
  • PowerBroker for Unix & Linux – Powerful host-based least privilege management
  • PowerBroker for Sudo – Centralized management and reporting
  • PowerBroker for Windows – Least privilege management for desktops and servers
  • Retina Enterprise Vulnerability Management – Enterprise vulnerability management

By processing activity coming from the vulnerability and delegation solutions, as well as network devices, BeyondTrust’s threat analytics solution can add rich context to any single event whether host or network initiated.

If you’d like to speak with us to learn how we can help you identify and eliminate potential threats in your organization, contact us today.

Photograph of Martin Cannard

Martin Cannard,

Martin has been helping organizations solve challenges in the privileged account management and identity and access management space for over 24 years. At Dell Software, Martin managed a team of Solution Architects, focused on designing and implementing solutions in the Privileged Account Management (PAM) space. Prior to joining Dell, Martin was Sr. Product Manager for Novell Privileged User Manager, a privilege management application acquired from Fortefi, an organization where he served as Vice President, Corporate Development. Prior to this, he was Program Manager of Client Technologies at Symantec where he was responsible for many ground-breaking field and channel enablement applications. Additionally, Martin managed the European QA group at Axent Technologies and has held various management positions in consulting, systems development, and operations. Martin is a regular speaker for security events, and webinars.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Cybersecurity Insurance Checklist

Whitepapers

Privileged Access Management: PAM Checklist

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Podcast
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.