Monitoring And Understanding User Activity

Effective monitoring of user behavior can tip you off to a threat before it goes too far. Here are some tips on how to do it right

[The following is excerpted from Fundamentals of User Activity Monitoring, a new report posted this week on Dark Readings
Security Monitoring Tech Center
.]
Effective security programs must quickly identify system misuse, provide sufficient information to halt an attack, and help clean up any damage. How can IT administrators and business managers track anomalous behavior and detect attacks? Monitoring.
User activity monitoring is the only way to get ahead in the security game. Its how we identify attacks and system misuse -- while its happening and, its hoped, early enough to stop it. User activity monitoring is not simply a matter of randomly looking at activity; rather, its an examination of events linked to specific users across multiple systems to develop a complete picture of whats going on.
There are many reasons to monitor user activity. First and foremost, both attackers and malicious insiders leverage user credentials to misuse systems. Second, certain user behavior -- for example, the exfiltration of data from a database -- can signal a possible breach. Network monitoring tells us only so much, and no single device or application provides a whole story.
Exposing an ongoing attack -- or identifying the damage caused -- requires analysis of a chain of events across several services. By linking actions to users, monitoring paints a picture of the users intentions.
What does it mean to monitor user activity? It means capturing the actions of a user -- including the use of applications, services, networks, and data in your IT environment. There are several ways to monitor user activity, each with different strengths and weaknesses.
One method is to examine specific actions of users as they leverage IT resources -- which applications they use, which files they request, what databases they use, what portions of the network they are on, what operations they perform, and so on. If a user engages in whats considered a risky operation -- say, accessing a file containing credit card numbers -- monitoring systems will generate an alert with specific data noting why the operation is considered a security issue. In essence, were examining the action of some user against an IT resource and generating an alert if its a violation of existing policies.
Another method involves monitoring user behavior against historic usage patterns -- for example, comparing what users are doing now with what theyve done in the last 30, 60, or 90 days. If a user does something different from what he or she normally does -- for example, downloading an entire customer database as opposed to a single customer record -- an alert would be generated.
To learn more about the process of user activity monitoring -- and the tools and practices used to implement it --
download the free report on user activity monitoring
.
Have a comment on this story? Please click Add a Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Monitoring And Understanding User Activity