Electricity and Control September 2021

CYBERSECURITY

Insider threat detection for security and compliance John Mc Loughlin, CEO, J2

I n today’s modern and distributed enter- prise, it’s more difficult than ever to com- bat internal and external threats proactive- ly due to a lack of server visibility in the context of user behaviour, application up- dates and system configuration changes. This lack of visibility into data access, usage, modification, movement, upgrades and IP connections creates gaps in ‘intent’ awareness and means abnormalities that signal increasing risk, such as application deployments, administrative changes and new users, cannot be identified.

This is done by providing real-time visibility into all serv- er activity and applying advanced analytics to distinguish legitimate activity from malicious activity. Dtex’s advanced analytics engine continuously monitors servers to surface abnormalities, or indicators of intent, to help organisations autonomously identify threats to their environments, includ- ing those associated with data loss like reconnaissance, obfuscation and circumvention. It provides customers with the mission-critical ability to pinpoint threats early in the chain and identify risky behaviour before exfiltration at- tempts occur. Key capabilities and features that Dtex InTERCEPT de- livers to help organisations monitor and protect their serv- ers more completely include the following. ƒ Full visibility Traditional solutions focus either at the perimeters or only on the endpoints, creating security visibility gaps where or- ganisations store their information – on servers. By combin- ing behavioural data loss prevention with advanced server monitoring and protection, customers can protect their as- sets more effectively. ƒ Critical file monitoring Dtex allows customers to monitor particularly closely spe- cific files of interest, such as sensitive customer informa- tion, financials, intellectual property and more. Through continuous monitoring, Dtex automatically identifies abnor- mal activity to alert customers of any risky behaviours or threats associated with their most sensitive information. ƒ Privileged access monitoring Dtex InTERCEPT monitors users’ access of server resourc- es to ensure this privilege is not being abused. Its intelligent automation can easily spot anomalous access behaviour and flag activity that deviates from the norm, so customers can be assured that employees are operating as expected. ƒ Predictive data loss prevention Dtex InTERCEPT understands intent and context related to data loss by profiling and baselining user, application and system behaviours. Streaming and scored audit trails pro- vide customers with real-time awareness of abnormalities that indicate emerging risk to servers leading up to attacks. This helps Security Operations and IT teams eliminate risks before data is exfiltrated. ƒ Performance interoperability When applied to servers, Dtex InTERCEPT causes little to no impact on overall performance. The platform is deployed across even the largest environments with ease and has no noticeable impact on server workloads or performance. The increased visibility of activity combined with the built-in power of analytics and correlation helps customers improve compliance by ensuring they know exactly where they need to focus their attention.

Business leaders need to rethink server visibility, detection and protection, espe- cially considering the recent attacks on businesses and the technology platforms they run. In virtually every successful attack there were obvious abnormal ‘superuser’ account activities, anomalous file downloads and changes in packaged software processes. The attacks all offered ‘indicators of intent’ that should have triggered elevated risk scores and immediate investigative action. Most business leaders are still not aware that there are next-generation infrastructure awareness capabilities to protect cloud, on-premises and virtual servers from data breaches, insider threats and outsider infiltration. The latest Dtex InTERCEPT offerings provide these enhanced capabilities to monitor and secure server infra- structures. Its patent-pending DMAP+ technology drives intelligent meta-data collection and activity correlation across cloud, on-premises and virtual environments. This helps identify privileged account misuse, unauthorised use of administrative tools, unusual application updates and behaviour, systems configuration changes, domain fronting and more. This solution presents a level of visibility that synthesises access, activities and modifications so threats can be iden- tified and eliminated proactively, before data is exfiltrated. It protects servers deployed on-premises, cloud and virtual infrastructure from security threats.

J2 CEO, John Mc Loughlin.

For more information visit: www.j2.co.za

Monitoring data servers increases security levels.

30 Electricity + Control SEPTEMBER 2021