Overview of information security tools: users and data

Ruslan Rakhmetov, Security Vision

There are many different classifications of information protection systems (IPS). Some of them have become obsolete due to trends towards integration and creation of a common ecosystem, when the functionality of different systems begins to overlap.

Fig. 1 - Information security tools and interconnectivity

Large vendors also create their own integrated projects from their individual products. However, there is not yet such a large-scale ecosystem of information protection systems from a single developer, which would cover all the tasks of practical information security.

Therefore, we will divide our review of information security products into four major groups: in the first and second groups we will consider those products that target users and the data itself, and in the remaining two groups - the infrastructure.

Figure 2 - User Activity Monitoring (UAM) or Employee Monitoring (EM) - monitoring user activity

Usually client-server applications, which with the help of agents on workstations allow monitoring PCs of employees, logging their actions and already at the level of the server part of the software to perform analytics, highlight risks and deviations for managers, HR and IS service. The client part of the software is installed on users' computers, which allows to see what is inaccessible purely for network monitoring: work in applications, use of keyboard and mouse, connection of external alienated devices and operations with files.

UAM systems often allow not only monitoring, but also restricting a number of actions or organising remote access to PCs for the IT service, including the most basic functionality of DLP and PAM systems at the same time.

OBJECTIVES:

- Monitor the performance of employees and contractors

- Evaluate the effectiveness of employee communication and training

- Analyse user actions in applications and on the Internet.

Figure 3 - Privileged User/Access Management (PUM/PAM), Privileged Identity Management (PIM), Privileged Password Management (PPM) or Privileged Account Security (PAS) - managing the work of privileged users

Similarly, PAMs are client-server applications that extend the functionality of UAM/EM systems with additional capabilities to control privileged users. Such systems manage administrative access to a company's IT systems and usually include a single gateway to provide secure connectivity for company administrators and contractors.

Many privileged user management systems use a single repository of authorisation tokens (passwords as a first factor) and some include a repository of secrets (encrypted authorisation data from the system and database, often used in application development and integration of different systems), which is useful for both IT staff and incident investigations.

OBJECTIVES:

- Monitor the actions of privileged employees and contractors

- Evaluate operations and commands entered

- Recording on-screen and application-specific actions

Figure 4 - Second/Multi Factor Autentification (2FA/MFA) - multi-factor authentication and validation

Since employee actions often involve access to specific data, users need to be identified and authenticated. For this purpose, multi-factor authentication services add one or more other factors to the first factor (password): a code from SMS, a token stick, a one-time password from a special application, etc.

Thus, with the help of other devices, email addresses or phone numbers, it is possible to clarify from the user that it is he who is trying to access an application, document or other service, even if the original password has been compromised.

OBJECTIVES:

- User authentication, authentication

- Independence from compromise of the first factor (password)

- Increase protection of user access to data

Fig. 5 - Mobile Application Shielding (MAS) - mobile application security

The system is embedded in the mobile application code and analyses user activity to identify anomalies. In terms of tasks performed, this system is similar to two-factor authentication services, but in terms of architecture and principles it is more similar to UBA-systems, as user activity data is used for user authentication.

The module collects statistics about what time the user usually uses applications, what path through the interface they take, how hard and fast they press buttons, at what angle they hold the smartphone, etc. Deviations from the norm make it possible to suspect another user (possibly an attacker) accessing the app and triggering additional defences (e.g. MFA, which is described above).

OBJECTIVES:

- Securing mobile devices, protecting against fraud through the app interface

- Finding anomalies in user transactions

- Increasing the security of personal data and loyalty programmes

Figure 6 - User Behavior Analytics (UBA) and User and Entity Behavior Analytics (UEBA) - behavioural analysis and anomaly detection

UBA is a system for analysing user activity to find anomalies and capture potential incidents. In addition to collecting user activity statistics, UEBA also collects application/device logs, which is somewhat similar to MAS tools, only applied to computers and servers within a company.

UEBA-systems are often based on machine learning technologies without a teacher (without pre-created profiles of employees), although sometimes there are exceptions, in which profiles are embedded in the ‘black box’ mode. Therefore, to work effectively, the system needs to collect statistics from 3-9 months so that outliers are less likely to include false positives and employee profiles include more activities.

OBJECTIVES:

- Collect statistics on users, groups, profiles

- Search for anomalies that may be indicative of an incident

- Analysis of exceeding thresholds on different parameters

Fig. 7 - Incident Response Platform (IRP) - organising the incident response process

The Incident Response Platform made it to the first part of our review because it is directly related to users, only this time not to potential perpetrators, but to IS/EB/IT employees themselves. The system is used if there is a need to build common processes and automate actions. Modern IRP-systems have evolutionarily become part of SOAR-platforms, but since the term is already established on the market, let's analyse it in more detail.

Basically, such systems consist of two blocks: ticketing (accounting of requests, definition of executors, SLA, etc. as in ITSM-systems) and processing (business process configurator, similar in tasks to BPM and RPA class systems). Together they organise common processes and a single interface for the response team to deal with incidents.

OBJECTIVES:

- Process alignment and collaboration

- Manage the response team, SLAs and staff workloads

- Automate routines and eliminate human error.