4.permissiondenied

Privilegeduseractivitymonitoringandauditingwww.
eventloganalyzer.
comIntroductionOfalltheuseraccountsinyourorganization,privilegeduseraccountshavethemostbearingonyournetworksecurityduetotheiradministrativepower.
Yourorganization'ssensitivedatastores,criticalservers,andotherimportantnetworkdevicesareonlyassecureastheaccountsentrustedwiththeircare.
Theseaccounts—belongingtoyourorganization'sdatabaseadministrators,systemadministrators,andothernetworkadministrators—areprimetargetsforexternalattackerslookingtogainfullcontroloveryournetworkresources.
Butexternalthreatsaren'ttheonlyproblemorganizationsneedtoworryabout.
Administratorsmayexhibitmaliciousintentbyabusingtheirprivileges,ortheymayactcarelesslywiththeircredentialsorsystems.
Toaddtothis,multiplecompliancepoliciessuchasPCIDSSandSOXmandatethethoroughauditingofprivilegeduseractivity.
Thismakesprivilegeduseractivitymonitoringnotjustapreference,butanecessity.
Thisguideexplainsthebestpracticesforprivilegedusermonitoring,aswellashowEventLogAnalyzercanbeusedtoreportonallyourprivilegedusers'activitiesandalertyouaboutanysuspiciousactivity.
Privilegedusermonitoringbestpractices1.
Performaregularinventoryofcriticalassetsandprivilegedaccounts.
Inmidtolarge-sizenetworks,it'simportanttokeeptrackofnewlyaddedcriticalsystemsandapplicationsalongwiththeprivilegedaccountsassociatedwiththem.
Tracknewlycreatedusers=andpermissionchangestoknowwhichaccounts'rightshavebeenelevated.
Thisawarenesshelpsyoumaintaincompletevisibilityandcontroloveryournetworksothatnoprivilegedactivitygetsmissed.
2.
Enforcestrongprivilegedaccountsecuritypractices.
Giventhatprivilegedaccountsarelikelytargetsforattackers,ithelpstoenforcetightsecurityprotocolsaroundthem,likepasswordcomplexityrequirements,uniqueaccountsforeachuser,clearly-denedaccesspolicies,andmore.
Youcanalsotrackpasswordchangesandlogonactivitytoidentifyanyhackingattempts,anomaliesinaccountusage,possibleaccountsharing,andmore.
3.
Provideonlynecessarypermissions.
Evenprivilegeduserscanhavetoomanyprivileges.
Ausermaybegivenwriteaccesstoasensitivefolderwhentheyonlyneedtoreadit,ortheymaybegivenaccesstoanentiredatabasewhentheyonlyneedtoworkwithselectedrecords.
Whencriticalresourcesareaccessiblebyseveralunnecessaryusers,itonlyincreasesthechancesofabreach.
Thisiswhyprivilegedusersmustonlybeprovidedtherightstheyrequire.
4.
Maintainaseparationofdutiesbetweenprivilegedusersandthoseauditingthem.
Thetoolsandprocessesusedtomonitoryourprivilegedusersshouldnotbemanagedbytheprivilegedusersthemselves.
Yourmonitoringsolution'sadministratorsshouldbeindependentoftheremainingnetworkadministrators.
Thisseparationofdutieshelpsensurethatprivilegeduserscannottamperwiththeiraudittrailsorreports.
Entrustyourmonitoringandsecurityauditingactivitiestoyoursecurityoperationscenter(SOC).
5.
Reportonallprivilegedactivities.
Itisn'tnecessarytomonitoralltheactionsofregularemployees,butitisimportanttotrackallprivilegeduseractivities.
Anyactiontakenbyaprivilegeduser,likealogonfailureorcongurationchange,couldbeanindicatorofanongoingattack,howeverinnocentitmayseem.
Maintainingdetailedreportswillproveusefulduringcomplianceauditsorforensicinvestigations.
AuditingprivilegeduseractivitywithEventLogAnalyzer:ImportantreportsEventLogAnalyzerisacomprehensiveauditingsolutionthatletsyoucentrallymonitorallyournetworkdevices,servers,andapplications.
Thesolutionhelpsyouconstantlymonitoryourprivilegedusersandprovidesyouwithdetailedaudittrailsandreports;italsoalertsyouincaseanysuspiciousactivityisdetected.
Logonactivitymonitoring:Auditinglogonshelpsyouunderstandwhenandhowadministratorslogontoyournetwork,soyoucancatchanomalieslikepossibleaccountsharing,hackingattempts,orirregularlogontimes.
Somekeyreporttypesinclude:Reports:UnixLogons|UnixLogos|UnixFailedLogons|RouterLogons|RouterFailedLogons|FirewallLogons|FirewallFailedLogons|SessionActivityMonitoringReportsUseraccountchanges:Monitoringuseraccountchangeshelpsyoustayontopofthevariousprivilegedaccountsinyournetworkaswellasthevariouschangesmadetoaccountsettings.
Reports:UnixAddedUserAccounts|UnixDeletedUserAccounts|UnixGroupsAdded|UnixGroupsDeleted|PasswordChanges|FailedPasswordChanges|SpecialGroupsAssignedtoNewLogon|SymantecEndpointAdminsAdded|NessusAdminDiscoveryReport|NessusElevatedAdminPrivilegeFailuresSystemandcongurationchanges:Trackingimportantcongurationchangesmadebyprivilegedaccountsisessentialasasinglechangecouldcreateasecurityloopholethatallowsahackertogainaccesstoyournetwork.
Reports:SoftwareInstalled|FailedSoftwareInstallationsDueToPrivilegeMismatches|WindowsUpdatesInstalled|RegistryChanges|WindowsBackupandRestore|FirewallRuleAdded|FirewallRuleDeleted|FirewallSettingsChanges|RouterCongurationChanges|RouterCommandsExecutedSensitivedataaccess:Auditingprivilegedactivityoncriticaldatabaseandleservershelpsyouprotectsensitivebusinessdatafromunauthorizedaccess.
Reports:DDLAuditReports|PrivilegeAbuses|AdminAuthorityChanges|PermissionChanges|OwnerChanges|DatabaseBackupReport|DatabasePermissionDenied|AccessViolation|FilePermissionChangesHighlightsofEventLogAnalyzerAdvancedEventCorrelation:Theadvancedcorrelationenginecontainsoverthirtypredenedattackrules,includingthoseforransomware,bruteforce,andmore.
Youcancorrelatelogsfrommultiplelogsourcesandcreaterulestosuityourbusinessenvironment.
DynamicThreatIntelligence:Theadvancedthreatintelligenceplatformcomeswithabuilt-inSTIX/TAXIIfeedprocessor.
Youcangetreal-timealertsforsuspiciousinboundandoutboundtracfrommaliciousdomainsandcallbackservers.
Additionally,theadvancedthreatanalyticsadd-onprovidesdeeperinsightsonthemalicioussourceincludingdetailsonthereputationscoreoftheIP,historyonwhenitwasaggedasmalicious,geolocationofthethreatorigination,andmore.
Built-inincidentmanagementconsole:Tracktheresponseandresolutionprocessofincidentsbyautomaticallycreatingticketsfromalertsandassigningthemtotherightadministratorbasedonthedeviceordevicegroupthatgeneratedthealert.
Keeptrackofincidentticketswiththebuilt-inticketingoption,orraiseticketsinexternalhelpdesktools-ServiceDeskPlusandServiceNow.
Youcanalsochoosefromthemultiplebuilt-inworkowsthatautomaticallyrespondstoincidents,likedisablingcompromisedcomputersandlockinghackedormalicioususeraccounts.
Comprehensivelogmanagement:Collects,analyzes,correlates,searches,andarchiveslogdatafromover700logsources.
Includesacustomlogparsertoanalyzeanyhuman-readablelogformat.
In-depthauditreports:Accessintuitivereportswhichcanbeeasilyexportedorscheduled.
ThesereportsincludeIndependentprivilegeduseractivityreports:Getindividualreportsforvariousprivilegedactivities,suchascongurationchanges,softwareinstallations,sensitivedataaccessesandchanges,andmore.
Consolidatedreports:GetaconsolidatedviewofallprivilegeduseractionsinyourWindowsnetworkintheUserActivityOverviewreport.
ThegraphcanalsobebrokendownbyuserintheUserBasedReport.
Compliancereports:Generatepredenedreportsforvariouscompliancepolicies,includingSOXandPCIDSS,whichmandatethethoroughauditingofprivilegeduseractivitySecurityalerts:Receivenoticationaboutanyanomalousorsuspiciousactivityfromprivilegedusersinyournetwork.
Getalertsforindependenteventsormultipleeventscorrelatedacrossyournetwork.
Youcanalsogetthreatfeed-basedalertsandidentifycommunicationbetweenprivilegedusersandknownmaliciousentities.
Forensicinvestigations:Usetheadvancedsearchenginetoinvestigatesecurityincidentsanddiscovertheirrootcause.
Youcansavethesearchresultsasreportsandusethemtopresentanyndings.
Privilegeduseraccountsholdalotofpoweroveryournetwork.
WithEventLogAnalyzer,youcanensuretheyareusedresponsiblyandaresecuredagainstattacksEventLogAnalyzerisaweb-based,real-timelogmanagementandITcompliancesolutionthatcombatsnetworksecurityattacks.
Withcomprehensivelogmanagementcapabilities,EventLogAnalyzerhelpsorganizationsmeettheirdiverseauditingneeds.
Italsooersout-of-the-boxcompliancereportsandalertsthatmeetstringentITregulatorymandaterequirementswithease.