Insider threat detection for security and compliance

Issue 4 2021 Cyber Security

In today’s modern and distributed enterprise, it’s more difficult than ever to proactively combat internal and external threats due to a lack of server visibility in the context of user behaviour, application updates and system configuration changes.

This lack of visibility into data access, usage, modification, movement, upgrades and IP connections creates gaps in ‘intent’ awareness and fails to identify abnormalities that signal increasing risk, such as application deployments, administrative changes and new users.

Business leaders need to rethink server visibility, detection and protection, especially considering the recent attacks on both businesses and the technology platforms they run. In virtually every successful attack there were obvious abnormal superuser account activities, anomalous file downloads and changes in packaged software processes. These attacks all offered ‘indicators of intent’ that should have triggered elevated risk scores and immediate investigative action.

Most leaders are still not aware that there are next-generation infrastructure awareness capabilities to protect cloud, on-premises and virtual servers from data breaches, insider threats and outsider infiltration.

The latest DTEX InTERCEPT offerings provide these enhanced capabilities to monitor and secure server infrastructures. Its patent-pending DMAP+ technology drives intelligent metadata collection and activity correlation across cloud, on-premises and virtual environments. This helps identify privileged account misuse, unauthorised use of administrative tools, unusual application updates and behaviour, systems configuration changes, domain fronting and more.

This solution brings a level of visibility to the fore that synthesises access, activities and modifications to proactively identify and eliminate threats before data is exfiltrated. It protects servers deployed on-premises, on cloud and on virtual infrastructure from security threats. This is done by providing real-time visibility into all server activity and applying advanced analytics to discern legitimate activity from malicious activity.

DTEX’s advanced analytics engine continuously monitors servers to surface abnormalities, or Indicators of Intent, to help organisations autonomously identify threats to their environments, including those associated with data loss like reconnaissance, obfuscation and circumvention. It provides customers with the mission-critical ability to pinpoint threats early in the kill chain and identify risky behaviour before exfiltration attempts occur.

Key capabilities and features that DTEX InTERCEPT delivers to help organisations more completely monitor and protect their servers include:

Full visibility. Traditional solutions focus either at the perimeters or only on the endpoints, creating security visibility gaps where organisations store their information – on servers. By combining behavioural data loss prevention with advanced server monitoring and protection, customers can more adequately protect their assets.

Critical file monitoring. DTEX allows customers to closely monitor specific files of interest, such as sensitive customer information, financials, intellectual property and more. Through continuous monitoring, DTEX automatically identifies abnormal activity to alert customers of any risky behaviours or threats associated with their most sensitive information.

Privileged access monitoring. DTEX InTERCEPT monitors the access of server resources by users, in order to ensure this privilege is not being abused. Its intelligent automation can easily spot anomalous access behaviour and flag activity that deviates from the norm, arming customers with the assurance that employees are operating as expected.

Predictive data loss prevention. DTEX InTERCEPT understands intent and context related to data loss by profiling and base-lining user, application and system behaviours. Streaming and scored audit trails provide customers with real-time awareness of abnormalities that indicate emerging risk to servers, leading up to attacks. This helps SecOps and IT teams eliminate risks before data is exfiltrated.

Performance interoperability. When applied to servers, DTEX InTERCEPT causes little to no impact on overall performance. The platform is deployed across even the largest environments with ease and has no noticeable impact on server workloads or performance.

The increased visibility of activity combined with the built-in power of analytics and correlation helps improve your compliance by ensuring that you know exactly where you need to focus your attention.

For more information contact J2 Software, +27 11 794 1096, john@j2.cco.za, www.j2.co.za


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Understanding the evolving cybersecurity landscape
Issue 5 2021, Vox , Cyber Security
Given the global disruption that took place last year, it is hardly surprising that malware increased by 358% and ransomware by 435% as compared to 2019.

Read more...
Protecting business from ransomware at the edge
Issue 4 2021 , Cyber Security
It might not always be possible to prevent ransomware from infecting remote networks, however, a robust backup and disaster recovery strategy can get the business back on track if systems are locked down.

Read more...
How safe are our factories?
Issue 5 2021, Wolfpack Information Risk , Industrial (Industry), Cyber Security
In this, the first part of a series on cybersecurity for operational technology, Bryan Baxter asks how safe our factories are from cyber threats.

Read more...
Managing a breach or ‘dirty’ network
Issue 5 2021 , Editor's Choice, Cyber Security
Nasser Bostan, head of security sales, Middle East and Africa, BT, shares BT’s insights gleaned from the SolarWinds incident and offers recommendations for organisations to step up their cybersecurity strategies.

Read more...
Protecting your workforce
Issue 5 2021, J2 Software , Cyber Security
With Workforce Cyber Intelligence, organisations can reduce legal liability by identifying the personal online activities that put the enterprise at risk, while still protecting employee privacy.

Read more...
Can businesses really protect their customers?
Issue 5 2021 , Cyber Security
Cyber-criminals use many methods to extract data from businesses or individuals, but spam remains one of the key means of parting consumers from their cash.

Read more...
USBs threats are back
Issue 4 2021 , Cyber Security
Kaspersky has uncovered a rare, wide-scale advanced persistent threat (APT) campaign; initial infection occurs via spear-phishing emails containing a malicious Word document and can then spread to other hosts through removable USB drives.

Read more...
Incedo consolidates its cybersecurity defence
Issue 4 2021 , Cyber Security
Check Point Software´s end-to-end solution safeguards Incedo and its customers from a global spike in cyberattacks, while reducing costs and increasing productivity.

Read more...
Top 10 security misperceptions
Issue 4 2021 , Cyber Security, Security Services & Risk Management
The Sophos Rapid Response team has compiled a list of the most commonly held security misperceptions they’ve encountered in the last 12 months while neutralising and investigating cyberattacks in a wide range of organisations.

Read more...
Top cybersecurity considerations for SMEs in 2021
Issue 3 2021 , Cyber Security, News
Cisco has published its 2021 SMB Security Outcomes Study, highlighting what SMB leaders are doing to thrive in today's ever-evolving threat landscape, as well as offering actionable insights on where they should focus.

Read more...