Audit BeyondTrust Remote Support (Cloud)
BeyondTrust Remote Support provides two types of support session logging. All the events of an individual support session are logged as a text-based log. This log includes representatives involved, permissions granted by the customer, chat transcripts, system information, and any other actions taken by the Remote Support representative. This data is available on the B Series Appliance in an uneditable format for up to 90 days, but it can be moved to an external database using the Remote Support API or the Remote Support Integration Client (IC). All support sessions are assigned a unique session ID referred to as an LSID. The session LSID is a 32-character string that is a unique GUID for each session. The LSID is stored as part of each session log for every session conducted.
Remote Support also allows enabling video session recordings. This records the visible user interface of the customer screen for the entire screen sharing session. The recording also contains metadata to identify who is in control of the mouse and keyboard at any given time during the playback of the recorded session. The period of time these recordings remain available depends on the amount of session activity and the available storage, up to 90 days maximum. As with the support session logging, these recordings can be moved to an external file store using the API or the IC.
The Remote Support Integration Client can be used to export data from the site and store it if needed to comply with security policies. Remote Support can also be configured to store data for a shorter period of time to help comply with security policies.
The Integration Client (IC) is a Windows application that uses the Remote Support API to export session logs, recordings, and backups from the Remote Support Cloud site according to a defined periodic schedule. The IC uses plug-in modules to determine the repository for the exported data.
Remote Support provides two IC plug-in modules. One handles export of reports and video recordings to a file system destination. The second exports select report information (a subset of the entire data collection) to a Microsoft SQL Server database. Setup of the IC for SQL Server includes all of the procedures needed to automatically define the necessary database, tables, and fields.
In practice, the IC is used to export support session data that must be retained for legal and compliance reasons. The reports and recordings are archived in a file system, indexed by session IDs. Data stored in the SQL Server tables can be queried to locate the Remote Support session ID corresponding to given search criteria such as date, representative, or IP address.
All authentication events, such as when a representative logs into the representative console or accesses the /login interface, generate a syslog event that can be logged on a syslog server. Additionally, any configuration change that is made to the Remote Support Cloud instance also generates a syslog event showing the change that was made and by which user.