| Listen on Yandex Music | Listen on Podcast Addict | Listen on Pocket cast |
Ruslan Rakhmetov, Security Vision
When it comes to improving one's own efficiency, it is often advised to use diary entries, calendar and evaluate one's actions as a whole. The use of such monitoring can be driven not only by the need to apply KPIs, but also to improve quality, prevent burnout, create a training plan or even organise a chain of communication to speed up various processes.
- Planners and meetings are designed to synchronise statuses and set milestones for ongoing processes.
- Timesheets describe ‘timekeeping’ and categorise working hours into tasks.
When it comes to monitoring employee actions in a company, the methodology remains similar, only enriched by additional corporate automation tools, when constant meetings and manual analysis of working hours are replaced by the collection of statistics without human involvement.
Organisationally , monitoring can be carried out as a photograph of an employee's working day, when it is carried out by a manager who tracks all processes.
Technical means are different: some of them provide monitoring regardless of work duties, others are more ‘customised’ for specific accounts; both classes of solutions are united by common goals, but differ in details:
- UAM systems perform User Activity Monitoring, while the term EM - Employee Monitoring - is slightly less common, although functionally they are the same class of systems.
- For users with increased privileges and capabilities (Privileged) there are also PAM, PUM or PIM systems, which have in their arsenal of functions that are more convenient for controlling system administrators, external contractors and other users with a wide range of rights;
- ACS systems provide ‘access control and management’, which is most often based on the use of special smart cards and passes. Such systems allow monitoring, for example, the time of passage through turnstiles or printing on shared printers, effectively adding to the overall picture.
The purpose of this article is to review monitoring techniques (without management and control), so we will mainly talk about the general functionality of several classes of products, and the subtleties and details of control will be considered separately. It should be noted that we at Security Vision are not in favour of using products of this class and assume that the specialists of our company have skills of self-organisation and do not need total control. Nevertheless, the means of monitoring employee actions occupy their own niche on the IT market, are of interest to specialists and deserve to be considered from a scientific point of view.
Let's start with the technical side and architecture, which for maximum efficiency usually consists of two key elements:
- One part of the software runs centrally (SERVER), which allows to collect data from all connected sources into common statistics.
- The second part is installed on user hosts (AGENT) to ensure that all channels that cannot be seen from a centralised host are monitored. For example, analysis of text entered from the keyboard, activity in installed programs and what happens between the workstation and peripherals.
Figure 1. Architecture of monitoring systems
Technically it is very similar to the architecture of DLP-systems that we have considered earlier. The existing solutions on the market somehow try to combine functionality and become universal for both tasks, so they are very similar in components. However, monitoring systems are usually simpler, without interfering with the traffic itself, without blocking and additional control functions.
UAM system allows you to solve many tasks related to security and process optimisation:
- By monitoring the programmes being run and recording the time spent in them, software procurement management processes can be triggered. Not only can the number of employees using the purchased software be visualised, but also the number of employees who can be trained if the statistics show that an employee is spending too much time on tasks (and may be too embarrassed to ask for help). In order to optimise further, lifecycle and update processes can be run through asset management and inventory management software.
- By monitoring keyboard text typing, overall security can be improved. Every person has their own unique keyboard handwriting and some systems are able to analyse it (e.g. Stakhanovets). Thus, if the number of typos increases, the speed of text input changes or any combinations are used, the UAM system is able to realise that someone else is working at one user's computer. In order to increase protection, it is possible to run two-factor authentication and temporary account lockout via a domain controller through the SOAR platform.
- Monitoring of used web services will allow you to configure the necessary accesses on the proxy server and ensure smooth operation of all business processes related to activity on the network.
- Monitoring of file operations will allow you to track mass deletions of files and optimise backup tasks.
- Remote PC management will allow you to manually or with the use of automation and orchestration tools to run necessary scripts, disconnect the connection or switch on the computer in wake on lan mode.
- UAM-systems also often allow monitoring images from webcams, which can be used for security purposes. Of course, many people, even in the IS sector, cover cameras with stickers to manage their personal security, but technically, with online facial recognition (few UAMs have it, for example in Stakhanovets) it is possible to lock the screen when the ‘wrong’ user appears.
Also UAM systems can include DLP-functions, such as creating digital prints of documents or shadow copies during file operations (we have already considered these functions separately in another article), which allows to implement additional protection against data leaks in case a full-fledged DLP-system is not yet implemented.
Fig. 2. Monitoring capabilities
Also, systems of different classes can be integrated with each other:
1. Data from ACS systems can be sent directly to UAM-systems to combine monitoring of the office as a whole and point actions on workstations.
2. Data from PAM systems can be sent to IRP/SOAR class systems, as part of the organisation of access issuance processes and interaction with contractors.
3. Data from UAM-systems can be used for point investigations in case of incidents from DLP-systems (in case of detection of confidential data leakage) or SIEM-systems (in case of attempts, for example, to brute force a password to an account).
Etc.
To create a unified ecosystem, the following are used:
- separate solutions from a single vendor that are already natively linked by developers (Traffic Monitor as DLP + Activity Monitor as EM from InfoWatch vendor );
- parsing and extracting data from databases of different sources into a single BI system (e.g. Device Lock as DLP + StaffCop as UAM from different vendors);
- SDK API connector development tools that can be applied to self-written systems;
- low-code tools for integration (SOAR platforms and integration of any systems and DBMS).
Thus, various tools help to solve optimization tasks: monitoring of actively used software will help to save money on purchasing new licenses, monitoring of activities in different software will help to train employees who have difficulties in solving tasks but are shy to ask, monitoring of communications will help to correctly place employees in the office and organise HR processes, finally, with the help of various assessments it is possible to mark the most efficient employees and encourage their self-development.
.jpg)
