[Column] John Mc Loughlin: Insider threat detection for security and compliance

In today’s modern and distributed enterprise, it’s more difficult than ever to proactively combat internal and external threats due to a lack of server visibility in the context of user behaviour, application updates and system configuration changes.
 
This lack of visibility into data access, usage, modification, movement, upgrades and IP connections creates gaps in ‘intent’ awareness and fails to identify abnormalities that signal increasing risk such as application deployments, administrative changes and new users.
 
Business leaders need to rethink server visibility, detection and protection, especially considering the recent attacks on both businesses and the technology platforms that they run.
 
In virtually every successful attack there were obvious abnormal superuser account activities, anomalous file downloads and changes in packaged software processes. These attacks all offered ‘indicators of intent’ that should have triggered elevated risk scores and immediate investigative action.
 
Most leaders are still not aware that there are next-generation infrastructure awareness capabilities to protect cloud, on-premises and virtual servers from data breaches, insider threats and outsider infiltration.
 
The latest Dtex InTERCEPT offerings provide these enhanced capabilities to monitor and secure server infrastructures. Its patent-pending DMAP+ technology drives intelligent meta-data collection and activity correlation across cloud, on-premises and virtual environments.
 
This helps identify privileged account misuse, unauthorised use of administrative tools, unusual application updates and behaviour, systems configuration changes, domain fronting and more.
 
This solution brings forth a level of visibility that synthesises access, activities and modifications to proactively identify and eliminate threats before data is exfiltrated. It protects servers deployed on-premises, on cloud and on virtual infrastructure from security threats.
 
This is done by providing real-time visibility into all server activity and applying advanced analytics to discern legitimate activity from malicious activity.
 
DTEX’s advanced analytics engine continuously monitors servers to surface abnormalities, or Indicators of Intent, to help organisations autonomously identify threats to their environments, including those associated with data loss like reconnaissance, obfuscation and circumvention.
 
It provides customers with the mission-critical ability to pinpoint threats early in the kill chain and identify risky behaviour before exfiltration attempts occur.
 
Key capabilities and features that DTEX InTERCEPT delivers to help organisations more completely monitor and protect their servers include:
 
Full visibility
 
Traditional solutions focus either at the perimeters or only on the endpoints, creating security visibility gaps where organisations store their information - on servers. By combining behavioural data loss prevention with advanced server monitoring and protection, customers can more adequately protect their assets.
 
Critical file monitoring
 
Dtex allows customers to closely monitor specific files of interest, such as sensitive customer information, financials, intellectual property and more. Through continuous monitoring, Dtex automatically identifies abnormal activity to alert customers of any risky behaviours or threats associated with their most sensitive information.
 
Privileged access monitoring
 
DTEX InTERCEPT monitors the access of server resources by users, in order to ensure this privilege is not being abused. Dtex’s intelligent automation can easily spot anomalous access behaviour and flag activity that deviates from the norm, arming customers with the assurance that employees are operating as expected.
 
Predictive data loss prevention
 
DTEX InTERCEPT understands intent and context related to data loss by profiling and baselining user, application and system behaviours. Streaming and scored audit trails provide customers with real-time awareness of abnormalities that indicate emerging risk to servers leading up to attacks. This helps SecOps and IT teams eliminate risks before data is exfiltrated.
 
Performance interoperability
 
When applied to servers, DTEX InTERCEPT causes little-to-no impact on overall performance. The platform is deployed across even the largest environments with ease and has no noticeable impact on server workloads or performance.
 
The increased visibility of activity combined with the built-in power of analytics and correlation helps improve your compliance by ensuring that you know exactly where you need to focus your attention.

John Mc Loughlin is the CEO of J2 Software