Best Way to Track Non-Asset Logins on a Network

Hello Experts!  Hoping I can get a little input for my question.   We use ESM as our SIEM, and I'd like to utilize a report or dashboard from ESM to help better track those logging into our network with non-company asset machines.   Here's a quick scenario of what we'd like to capture or other behavior similar:

Let's say Juan gets into the building after hours.  He plugs in his personal laptop to network drop, and using Jane Doe's password that he obtained by shoulder surfing her earlier, logs in as her.  What would be the best way to track this kind of behavior as well as any non-company asset machine log-ins within an ESM report or a dashboard.  

Any help with this is GREATLY APPRECIATED!
itsmevicAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

btanExec ConsultantCommented:
Couple of resources (by the way, I am not trying to do as selling here but anomalous activities are something any SIEMS should have as baseline and just that ESM itself package it as it is hence I suggest you check that out ... of course there can be other more and lean towards data analytics and machine learning to sieve out the "innocent" activities which is actually not legit).

e.g.  ArcSight Insider Threat Package (or sometimes they termed it as 'ArcSight ThreatDetector') - Addressing Insider Threats with ESM (it has many more example of such insider or similar)
(more descriptive)
http://viewer.media.bitpipe.com/1120682139_877/1297107228_284/Addressing_Insider_Threats_With_ESM.pdf
(brief summary glance)
http://h20195.www2.hp.com/V2/GetPDF.aspx%2F4AA4-3193ENW.pdf

ArcSight can consider operational time – the ability to use a time baseline of network and system usage. For example, the finance team rarely accesses the financial database before 5am or after 8pm, or perhaps outbound email activity is relatively slow during non-business hours. All of these parameters can lead to a powerful correlation capability that renders prioritized events. Based on these prioritized events, automated actions can be taken in the form of generating alerts, firewall rule changes, router ACL changes, creating a case or launching software..

 ArcSight Pattern Discovery product, ArcSight ESM has native anomaly detection that provides the reciprocal of pattern discovery. It will detect statistical anomalies, one-offs and events that don’t appear to be part of normal traffic patterns....

Active lists are extremely valuable for larger organizations because they help track suspicious network activity, such as somebody attacking or scanning the network, devices that have been compromised, users that appear to be malicious, target ports prone to attack or any other parameter of a packet.

Active lists can be built to represent any group the organization finds significant. For example, if a network is experiencing a horizontal port scan, it is likely that it will not be a high priority event. In fact, many organizations regularly experience such high volumes of scanning activity so that when the port scans stop, it is cause for alarm because perhaps the network is experiencing difficulty.

In summary, it can be via using the package for early detection of insider activity based on early warning indicators of suspicious behavior, such as:
- Stale or terminated accounts
- Excessive file printing, unusual printing times and  keywords printed
- Traffic to suspicious destinations
- Unauthorized peripheral device access
- Bypassing security controls
- Attempts to alter or delete system logs
- Installation of malicious software

Best is tracked the super admin or privileged user activities with privileged identity audit log (most commonly from those identity provider and provider such as cyberark, xceedium etc). SIEMS is as intelligent as it can get with the data and w/o the data (or log) it is tougher to derive true positive reliably or statistically.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
itsmevicAuthor Commented:
Reviewing.
0
itsmevicAuthor Commented:
Thank you.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.