Data Protection & the Insider Threat

Issue 2 1 Data Protection & the Insider Threat 4 Veriato Recon 6 Veriato 360 Data Protection & the Insider Threat 8 Research from Gartner: Market Guide for User and Entity Behavior Analytics Veriato (formerly known as SpectorSoft) has With multiple studies and surveys showing 22 Contact Us been enabling greater insight into insider actions that 50% of employees believe it is OK to take for over a decade. Thousands of companies, corporate data, the chances your organization has, government agencies, educational institutions is, or will experience insider driven data exfiltration and non-profits have successfully used Veriato are unacceptably high. In addition, the constant solutions to increase the security of critical stream of data breaches caused by imposters – systems and intellectual property, and to more external actors who level compromised credentials quickly and effectively respond to incidents. to “become” insiders – highlights the need to detect changes in insider behavior that suggest An established leader in employee monitoring attack. and investigations, we recognized the need for greater intelligence about the behavior of insiders. If you do not have a plan in place to detect it, you Many solution providers have done the same will miss your chance to prevent the damage. -- as evidenced by the Market Guide to User and Entity Behavior (“UEBA”) from Gartner Research With our unique ability to collect data at the point contained within these pages. of interaction between insiders and the IT resources they access, we saw an opportunity to help address Why Veriato? this challenge. Veriato has a proven data collector; As we set out to create a high value, differentiated one that provides much greater visibility into offering, we first focused on the need to secure insider activity than is available from logs. data. Insider data exfiltration causes tremendous damage every year. Worse, the vast majority of By applying an analytics capability to the data, we insider data exfiltration goes undetected – simply are able to detect shifts in behavioral patterns that because the organization is not looking for it. would otherwise go unnoticed. Our software does this by creating a baseline that reflects normal Ask yourself how your organization detects behaviors within your organization. Utilizing things like insider data theft or leaks. Relying on machine learning and statistical analysis, the technologies designed primarily to secure the software identifies deviations from the baseline – perimeter leaves much to be desired. Relying on anomalies – that suggest threat to data security. trust is only an option if the only employee is you. 2 One way Veriato Recon, our UEBA solution, differs With a few clicks, the data stored by Veriato from many others is that we look at both technical Recon can be transferred into Veriato 360. Once indicators and psycholinguistic indicators. The transferred, deep, context-rich visibility into the ability to look at these two very different sources actual actions taken by the insider is available. of intelligence translates into early warnings and CIRT and CSIRT teams around the world use easier prioritization. Veriato 360 for exactly this purpose: to identify and respond to security issues, to rule out false A simple example illustrates the point. One insider positives being generated by other systems, and is triggering alerts from a technical indicator such to conduct investigations. The combined power of as increased usage of USB drives with no other Veriato Recon and Veriato 360 equates to a robust indication of threat. Another insider is triggering insider threat detection and response solution. the same alerts, but is doing so after showing a significant negative shift in the sentiment (tone & One of the keys for us when building our UEBA intensity) of their communications and other shifts solution was to make it both usable and powerful - in language usage suggesting they are engaged to deliver a solution that could be up and running in insider threat behavior. The second insider’s in a short period of time, without lengthy and activity has a greater likelihood of being attack expensive professional services engagements related and should receive prioritized response. and the need for heavy customization. We set And that response can take place prior to the data out to build a product that would deliver value to exfiltration taking place – in the form of closer organizations no matter where they were on their inspection of activities and monitoring for unusual behavioral analytics journey - to those just starting resource access. out and to those with dedicated and sophisticated teams. We think we’ve done just that. Once Veriato Recon detects anomalies, it sends alerts. These alerts can be routed to a SIEM A Deeper Dive into the Veriato Approach solution to operationalize them and integrate Let’s take a closer look at the data for analysis. them with other sources of information. However, if you do not have a SIEM solution in place, Veriato Veriato focuses on human activity. Our job is to Recon can send alerts directly to appropriate staff eliminate blind spots and to catch things that for review and action, or via syslog to any other might otherwise fall through the cracks. solution you wish. Our data collector gathers a wide array of As a security analyst reviews the data and information about exactly what the insiders in determines that additional steps must be taken an organization are doing, including applications to investigate and respond to a potential attack, used, web activity and network usage, as well as: Veriato offers a very unique benefit. Veriato Recon stores up to 30 days of detailed user activity User Status – tracks things like logon and logoff, data – the data that underpins the alerts. Veriato as well as the amount of time that a user is Recon also operates from the same management spending within applications. console as Veriato 360, our monitoring solution that enables rapid exploration and review of user Communications Activity – which fuels our ability activity data. to track common date exfiltration methods, as well as analyze psycholinguistic indicators for early warning of elevated insider risk. 3 Document tracking and file transfers – which indicators can be gathered, without any human provides insight into what information is being eyes on the content of the communications, accessed and what is being done with it once by bulk analysis using machine reading and accessed. algorithms that identify changes in patterns of communication. Adding a psycholinguistic Keystrokes – which enables visibility into what component to your insider threat detection insiders are doing within applications and program can be the difference between proactive documents, as well as monitoring of highly interdiction and reactive incident response. privileged users who have the potential to damage the organization’s security with a few keystrokes. The Insider has options An insider, should they decide to take information With this rich set of user activity data to analyze, against company policy has an array of options we are able to detect meaningful anomalies across available to them simply by being inside the the range of methods insiders typically use to take technology moat. Everything from email, portable critical intellectual property out of the control of storage, personal cloud solutions, and even tried the organization. and true low tech printing of documents or screens is available to them. Psycholinguistics and the insider threat While monitoring and alerting on technical Contrasted with an external actor, who must indicators like the ones described above is widely attempt to take the data off to a remote server understood and employed, there are less obvious via a network connection, the scope of the task of methods that can and should be employed to detecting and preventing insider attacks becomes improve your organization’s security against the clearer. Dedicated insider threat detection possibility of a damaging insider attack. programs require User and Entity Behavior Analytics as a key component. Locking information Additional indicators, or metrics, exist that provide down tightly enough to make it truly secure isn’t early warning about an insider’s potential to an option – the productivity costs are too great. carry out such an attacks. The psychology of Rather, a comprehensive approach that includes language, known as psycholinguistics, is one device and data security, as well as recognizing such area. Indicators can be found in the digital that the human factor requires analysis of human communications of insiders that, when present, behaviors and activity, is needed to stop the insider are clear warnings that risk is elevated. These attack before it makes it into the media. Source: Veriato 4 ADVANCED INSIDER THREAT SOLUTION KEY BENEFITS For companies who have sensitive intellectual EARLY DETECTION AND WARNING property, which if stolen or exposed by insiders Veriato Recon’s behavioral analytics capability poses risk to the company, and want to protect provides critical insight into shifts in established critical information without restricting access or patterns that are directly related to insider threat locking systems down so tightly that productivity behavior. Early detection is key to mitigating risk, is hindered, Veriato Recon is User Behavior harm and the threats insiders pose. By focusing Analysis Software that provides early warning of directly on the behavior of insiders, Veriato suspicious behavior by passively monitoring user Recon can isolate anomalies and alert on them behavior and alerting when actions contradict immediately. policies or vary from well-defined patterns. SYSTEM OF RECORD Rather than focusing on protecting assets, Veriato Stop piecing together information from disparate Recon monitors user behavior for indicators of sources in an effort to reconstruct what happened. risk, recording and alerting when insider risk is Save time and money with a system of record that elevated, enabling rapid interdiction, reducing doesn’t require specialized expertise to decipher. false positives, and insuring actionable reporting.

Load more