BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Session Monitoring Provides Context Aware Security for Windows

Posted May 23, 2013    Morey Haber

The Windows world is about to get a long overdue lesson from Unix. Privilege Identity Management does not stop at just logging that an application gets launched with elevated privileges; administrators need to know what the user does with that application, as well.

Did they use the program within the guidelines of company policy or use it for some intentional or unintentional malicious activity? PowerBroker for Windows 6.0, which is due for general availability in a few weeks, has expanded its capabilities to capture processes, mouse clicks, keystrokes, and screen captures for elevated applications based on Rules.  And, to make it simpler, any rules including the ones you have deployed within your organization can be enabled for Session Monitoring:

PBW-Default-CricklewoodPolicy

After a session is captured, the data is compressed, encrypted, and securely transferred via policy to the Retina CS Threat Management Console. This data can be viewed, searched, and filtered to see exactly how privileged activity is used within your environment. Below is a sample from Retina CS 4.5 of what this looks like to an authorized administrator trying to change VMware workstation adapter settings:

PBW-session-viewer

The Unix world has known for a long time that recording these activities is critical for application security. PowerBroker for Unix & Linux does this natively and now with Retina CS 4.5 allows this data to be presented alongside its Windows counterparts in a single threat management console.  Regardless of platform, session and keystroke monitoring can be presented in one system. And, with the rest of BeyondTrust’s capabilities, full Privilege Identity and Vulnerability Management solutions are available as optional add-on modules.

BeyondTrust is redefining traditional security and helping companies understand the risk to users and assets. PowerBroker for Windows 6.0 allows Session Monitoring of user activity to identity the risk to applications running with elevated privileges. The art of measuring your information technology risk by user and application just got easier with BeyondTrust’s PowerBroker for Windows.

Launch a free evaluation today.

Tags:
, , , , ,

Additional articles

webinar 2

On Demand Webinar: Because Auditing Stinks Sometimes

Posted July 2, 2015    Lindsay Marsh

Auditing stinks. Well, mostly stinks. In this on demand webinar, lead by Group Policy MVP Jeremy Moskowitz, you’ll learn the three key tenets to real Group Policy auditing. Tenet 1: Why do you care about Group Policy auditing? Tenet 2: How does Eventing help you know “Who did what?” Tenet 3: How does Reporting tell…

Tags:
, , , ,
skeletonkey3_713678_713680

Stopping the Skeleton Key Trojan

Posted June 29, 2015    Robert Auch

Earlier this year Dell’s SecureWorks published an analysis of a malware they named “Skeleton Key”. This malware bypasses authentication for Active Directory users who have single-factor (password only) authentication. The “Skeleton Key” attack as documented by the SecureWorks CTU relies on several critical parts.

Tags:
, , , , ,
webinar 2

On Demand Webinar: 10 Steps to Building an Effective Vulnerability Management Program

Posted June 26, 2015    BeyondTrust Software

In this on demand webinar, Cybersecurity Expert, Derek A.Smith will take you through his 10 steps for a successful vulnerability management program and how to get started now.

Tags:
, ,