BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Session Monitoring Provides Context Aware Security for Windows

Posted May 23, 2013    Morey Haber

The Windows world is about to get a long overdue lesson from Unix. Privilege Identity Management does not stop at just logging that an application gets launched with elevated privileges; administrators need to know what the user does with that application, as well.

Did they use the program within the guidelines of company policy or use it for some intentional or unintentional malicious activity? PowerBroker for Windows 6.0, which is due for general availability in a few weeks, has expanded its capabilities to capture processes, mouse clicks, keystrokes, and screen captures for elevated applications based on Rules.  And, to make it simpler, any rules including the ones you have deployed within your organization can be enabled for Session Monitoring:

PBW-Default-CricklewoodPolicy

After a session is captured, the data is compressed, encrypted, and securely transferred via policy to the Retina CS Threat Management Console. This data can be viewed, searched, and filtered to see exactly how privileged activity is used within your environment. Below is a sample from Retina CS 4.5 of what this looks like to an authorized administrator trying to change VMware workstation adapter settings:

PBW-session-viewer

The Unix world has known for a long time that recording these activities is critical for application security. PowerBroker for Unix & Linux does this natively and now with Retina CS 4.5 allows this data to be presented alongside its Windows counterparts in a single threat management console.  Regardless of platform, session and keystroke monitoring can be presented in one system. And, with the rest of BeyondTrust’s capabilities, full Privilege Identity and Vulnerability Management solutions are available as optional add-on modules.

BeyondTrust is redefining traditional security and helping companies understand the risk to users and assets. PowerBroker for Windows 6.0 allows Session Monitoring of user activity to identity the risk to applications running with elevated privileges. The art of measuring your information technology risk by user and application just got easier with BeyondTrust’s PowerBroker for Windows.

Launch a free evaluation today.

Tags:
, , , , ,

Additional articles

CyberResiliency

6 things I like about Gartner’s Cyber Resiliency Strategy

Posted August 27, 2015    Nigel Hedges

There were 6 key principles, or recommendations, that Gartner suggested were important drivers towards a great cyber resiliency posture. I commented more than once during the conference that many of these things were not new. They are all important recommendations that are best when placed together and given to senior management and the board – a critical element of organisations that desperately need to “get it”.

Tags:
,
powerbroker-difference-1

Why Customers Choose PowerBroker: Flexible Deployment Options

Posted August 26, 2015    Scott Lang

BeyondTrust commissioned a study of our customer base in early 2015 to determine how we are different from other alternatives in the market. What we learned was that there were six key differentiators that separate BeyondTrust from other solution providers in the market. We call it the PowerBroker difference,

Tags:
, ,
Mac-Security-Enterprise

On Demand Webinar: Security Risk of Mac OS X in the Enterprise

Posted August 20, 2015    BeyondTrust Software

In the last several years, Mac administrators have come to realize that they may be just as vulnerable to exploits and malware as most other operating systems. New malware and adware is released all the time, and there have been serious vulnerabilities patched by Apple in the past several years, some of which may afford attackers full control of your systems.

Tags:
, ,