UserLock and FileAudit help guard against rogue sys admins
Back in September 2010, Network World published an insightful article by Carolyn Duffy Marsan, titled «6 tips for guarding against rogue sys admins».
In this article, Carolyn underlined the fact that «one of the biggest threats that organizations face is losing sensitive data […] to theft from their own employees. The threat is greatest from systems and network administrators, who have privileged access to vast amounts of corporate data and are responsible for most compromised records in insider cases.»
Carolyn then described several practical steps IT departments can take to minimize the insider threat, including:
«Restrict and monitor users with special privileges»
More easily said than done if you only rely on native Windows features. Windows lacks the fundamental and classic login session controls found in other environment like mainframe and midrange systems, UNIX and Netware.
UserLock comes in handy here, as this software solution allows CIOs to:
- limit or prevent concurrent logins to a Windows network, based on user, user groups or session types,
- restrict user access to the network with multiple criteria: workstations, time, business hours, and connection type,
- follow the session activity on the network in real-time and get detailed, graphical reporting,
- automatically receive popup or email alerts for specific events such as denied logins, successful logins and logoffs.
«Keep user access and privileges current, particularly during times of job changes or layoffs»
Here again, native Windows features are not really oriented to easily provide this functionality.
Imagine the following example:
A Sys Admin (let us call him John) is fired and knows that his dismissal is coming. John is logged on at 04:00 pm and at 04:05 pm the CIO disables and/or deletes his account. Guess what happens? John is still logged on to a workstation and connected to some servers. All he has to do is unlock the workstation, (typically workstations do not go and check unlock requests with the domain controller). The result is that John is still able to work on his desktop and local drives, even though his account has been disabled and deleted.
With UserLock, a CIO can remotely lock, logoff and reset all sessions immediately, from potentially anywhere using the Web interface.
«Monitor employees found guilty of minor online misconduct»
When it comes to employees’ online behavior surveillance, two things are crucial:
To monitor logon sessions
Here again, native Windows features are not sufficient. System Admins are not able to answer the following questions in real time:
- Who is logged on at which computers?
- Which computers are being used by a given user?
- Who are the users currently logged on at this particular computer?
UserLock allows real time session surveillance and monitoring; at all times a CIO knows who is connected, from what workstation(s), since when…
To monitor access to files and folders
To monitor access to an organization’s files and folders, standard Microsoft systems only propose manual event logs. This functionality leaves administrators with hundreds or even thousands of events to decrypt and analyze to pinpoint the information of interest. This generates endless hours of non productive and error-prone work.
FileAudit monitors, archives and reports on access (or access attempts) to sensitive files and folders stored on Microsoft Windows systems.
FileAudit instantly gives a comprehensive list of:
- read/write accesses
- file ownership changes (accepted or denied)
- permission modifications (accepted or denied)
Each record details:
- the user
- the domain
- the date and time of connection and disconnection
for:
- a file
- a selection of files
- a folder and subfolder
- a selection of folders and subfolders
«Educate your employees about insider threat»
Raising employees’ awareness about insider threat is a key component of an efficient IT security strategy. Regular training or offering a hotline so that employees can anonymously report fraud are part of the insightful measures that should be taken to mitigate insider threat. But one of the most efficient ways to make users security aware is to systematically remind them of their rights and duties each time they log on.
UserLock allows notifying all users prior to gaining access to a system with a tailor- made disclaimer. Users can for example be advised that system usage is monitored, recorded, subject to audit, and that unauthorized use is prohibited and subject to criminal and civil penalties.
Another efficient way is to provide users at each connection with detailed information about their previous logons, so they can easily detect if someone else had successfully logged on (or attempted to log on)as them and potentially impersonated them. This is missing from native Windows features.
At each logon, UserLock provides users with information such as:
- last workstation logged on,
- date and time of last successful logon,
- history of all logons denied by UserLock and Windows since last successful logon,
- number of logons denied by UserLock and Windows since last successful logon.
We look forward to your comments and concerns. Feel free to post your remarks hereunder or use Twitter or Facebook to exchange with us.
