CERT, Carnegie Mellon University Software Engineering Institute’s center for conducting and coordinating information security research, has released the Common Sense Guide to Prevention and Detection of Insider Threats, Version 3.1.
This valuable, insightful document (PDF - 88 pages) provides a comprehensive range of best practices to mitigate insider threat. And UserLock, our software solution to secure access to Microsoft Windows-based networks, can greatly help implementing a large part of them.
CERT BEST PRACTICE 2: Clearly document and consistently enforce policies and controls
“A consistent, clear message on organizational policies and controls will help reduce the chance that employees will inadvertently commit a crime or lash out at the organization for a perceived injustice.”
UserLock allows notifying all users prior to gaining access to a system with a tailor-made warning message.
These messages can for example include:
- a tailor-made legal disclaimer, including acceptable use of organization’s systems, information, and resources
- last workstation logged on
- date and time of last successful logon
- history of all logons denied by UserLock and Windows since last successful logon
- number of logons denied by UserLock and Windows since last successful logon.
CERT BEST PRACTICE 4: Monitor and respond to suspicious or disruptive behavior
“One method of reducing the threat of malicious insiders is to proactively deal with suspicious or disruptive employees.”
UserLock allows real time session surveillance and monitoring; at all times, a system administrator knows who is connected, from what workstation(s), since when… and can remotely lock, logoff and reset all sessions, either from the administration console or the Web interface.
CERT BEST PRACTICE 7: Implement strict password and account management policies and practices.
“If the organization’s computer accounts can be compromised, insiders can circumvent manual and automated control mechanisms.”
UserLock allows:
- simultaneous logon (same ID, same password) limitation or prohibition, per user or user group, thus reducing the ability of users to share their credentials and preventing accountability and non-repudiation issues.
- defining working hours and/or maximum session time for protected users. Outside of this (these) timeframe(s) and/or when time is up, users will be disconnected with prior warning.
- user group’s network access restriction per workstation or IP range. By doing this, users can be limited to their own workstation, department, floor, building…
CERT BEST PRACTICE 12: Log, monitor, and audit employee online actions
“Logging, monitoring, and auditing can lead to early discovery and investigation of suspicious insider actions.”
As seen here above, UserLock allows real time session surveillance and monitoring, but it also records all session logging and locking events in an ODBC database (Access, SQL Server, Oracle, MySQL …) for future reference.
Reports can automatically be generated at regular intervals, in order to update an Intranet Web site, or being sent by Email.
UserLock provides predefined reports, including:
- Session History: Comprehensive session list (logon, lock, logoff instances, users, domains, workstations…)
- Session Statistics: Displays for a given user and period, total sessions, total connection time, average time per session, per worked day or per week.
- User Sessions: Instantaneous view of all user session at display time.
CERT BEST PRACTICE 14: Deactivate computer access following termination
“It is important to follow rigorous procedures that disable all access paths into the organization’s networks and systems for terminated employees.”
With UserLock, an administrator can within seconds remotely lock, logoff and reset all sessions, either from the administration console or the Web interface.
Windows native features will indeed not prevent an employee to log onto his/her workstation even if his/her account has been disabled and deleted…
In-depth information in our whitepaper “Eight Holes in Windows Login Controls”
Detailed information about UserLock and free, fully-functional 180-day trial version
