Solved

Best Way to Track Non-Asset Logins on a Network

Posted on 2014-07-30
3
481 Views
Last Modified: 2014-08-18
Hello Experts!  Hoping I can get a little input for my question.   We use ESM as our SIEM, and I'd like to utilize a report or dashboard from ESM to help better track those logging into our network with non-company asset machines.   Here's a quick scenario of what we'd like to capture or other behavior similar:

Let's say Juan gets into the building after hours.  He plugs in his personal laptop to network drop, and using Jane Doe's password that he obtained by shoulder surfing her earlier, logs in as her.  What would be the best way to track this kind of behavior as well as any non-company asset machine log-ins within an ESM report or a dashboard.  

Any help with this is GREATLY APPRECIATED!
0
Comment
Question by:itsmevic
  • 2
3 Comments
 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 40231487
Couple of resources (by the way, I am not trying to do as selling here but anomalous activities are something any SIEMS should have as baseline and just that ESM itself package it as it is hence I suggest you check that out ... of course there can be other more and lean towards data analytics and machine learning to sieve out the "innocent" activities which is actually not legit).

e.g.  ArcSight Insider Threat Package (or sometimes they termed it as 'ArcSight ThreatDetector') - Addressing Insider Threats with ESM (it has many more example of such insider or similar)
(more descriptive)
http://viewer.media.bitpipe.com/1120682139_877/1297107228_284/Addressing_Insider_Threats_With_ESM.pdf
(brief summary glance)
http://h20195.www2.hp.com/V2/GetPDF.aspx%2F4AA4-3193ENW.pdf

ArcSight can consider operational time – the ability to use a time baseline of network and system usage. For example, the finance team rarely accesses the financial database before 5am or after 8pm, or perhaps outbound email activity is relatively slow during non-business hours. All of these parameters can lead to a powerful correlation capability that renders prioritized events. Based on these prioritized events, automated actions can be taken in the form of generating alerts, firewall rule changes, router ACL changes, creating a case or launching software..

 ArcSight Pattern Discovery product, ArcSight ESM has native anomaly detection that provides the reciprocal of pattern discovery. It will detect statistical anomalies, one-offs and events that don’t appear to be part of normal traffic patterns....

Active lists are extremely valuable for larger organizations because they help track suspicious network activity, such as somebody attacking or scanning the network, devices that have been compromised, users that appear to be malicious, target ports prone to attack or any other parameter of a packet.

Active lists can be built to represent any group the organization finds significant. For example, if a network is experiencing a horizontal port scan, it is likely that it will not be a high priority event. In fact, many organizations regularly experience such high volumes of scanning activity so that when the port scans stop, it is cause for alarm because perhaps the network is experiencing difficulty.

In summary, it can be via using the package for early detection of insider activity based on early warning indicators of suspicious behavior, such as:
- Stale or terminated accounts
- Excessive file printing, unusual printing times and  keywords printed
- Traffic to suspicious destinations
- Unauthorized peripheral device access
- Bypassing security controls
- Attempts to alter or delete system logs
- Installation of malicious software

Best is tracked the super admin or privileged user activities with privileged identity audit log (most commonly from those identity provider and provider such as cyberark, xceedium etc). SIEMS is as intelligent as it can get with the data and w/o the data (or log) it is tougher to derive true positive reliably or statistically.
0
 

Author Comment

by:itsmevic
ID: 40238257
Reviewing.
0
 

Author Closing Comment

by:itsmevic
ID: 40269036
Thank you.
0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One of the most frustrating experiences a help desk technician will ever encounter is when a customer comes to them with a solution of their own invention and expects the tech to implement it. This often happens when people with a little bit of tech…
Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question