Audit BeyondTrust Privileged Remote Access (Cloud)
BeyondTrust Privileged Remote Access (PRA) provides two types of session logging. All the events of an individual session are logged as a text-based log. This log includes users involved, session tools used, chat transcripts, system information, and any other actions taken by the PRA user. This data is available on the B Series Appliance in an uneditable format for up to 90 days, but it can be moved to an external database using the BeyondTrust API or the BeyondTrust Integration Client (IC). All sessions are assigned a unique session ID referred to as an LSID. The session LSID is a 32-character string that is a unique GUID for each session. The LSID is stored as part of each session log for every session conducted.
PRA also allows enabling video session recordings. This records the visible user interface of the endpoint screen for the entire screen sharing session. The recording also contains metadata to identify who is in control of the mouse and keyboard at any given time during the playback of the recorded session. The period of time these recordings remain available depends on the amount of session activity and the available storage, up to 90 days maximum. As with the session logging, these recordings can be moved to an external file store using the API or the IC.
The IC can be used to export data from the site and store it if needed to comply with security policies. PRA can also be configured to store data for a shorter period of time to help comply with security policies.
The IC is a Windows application that uses the API to export session logs, recordings, and backups from the PRA Cloud site according to a defined periodic schedule. The IC uses plug-in modules to determine the repository for the exported data.
BeyondTrust provides two IC plug-in modules. One handles export of reports and video recordings to a file system destination. The second exports select report information (a subset of the entire data collection) to a Microsoft SQL Server database. Setup of the IC for SQL Server includes all of the procedures needed to automatically define the necessary database, tables, and fields.
In practice, the IC is used to export session data that must be retained for legal and compliance reasons. The reports and recordings are archived in a file system, indexed by session IDs. Data stored in the SQL Server tables can be queried to locate the PRA session ID corresponding to given search criteria such as date, user, or IP address.
All authentication events, such as when a user logs into the access console or accesses the /login interface, generate a syslog event which can be logged on a syslog server. Additionally, any configuration change that is made to the PRA Cloud instance also generates a syslog event showing the change that was made and by which user.
