Working From Home: Internal Threats and External Attacks |complete Security
Working From Home: Internal Threats and External Attacks
# 1 Insider Threat: VPN Connections
Laura , the employee, has to use the VPN to access the corporate resources she needs to work.
Problem : She uses her personal computer as she does not have a company supplied laptop and it is not secure like her office computer.
Martin , the IT manager, normally only has a few open VPNs to watch.
With Netwrix Auditor for Network Equipment , he can easily review detailed information of all connections of his telecommuting users and quickly identify suspicious connections from unsecured devices or during abnormal hours. In addition, Netwrix monitors successful and failed connections.
When Paul tries to compromise Laura's VPN connection , Martin is able to detect and block him.
Insider Threat # 2: Company Data Downloads
Laura , the employee, consults several documents during her day and downloads them to the computer she works with so that she can access them at any time, so that she does not have to log back in each time. She also regularly leaves her VPN connection open.
Problem : She downloads confidential documents to her personal computer not secured by the company and they will remain there for an indefinite period.
Martin , the IT manager, ensures that the company's computers are well protected by his corporate security on his network and when they are mobile.
With Netwrix Auditor for Sharepoint, file server and network devices , it can easily detect if there is an abnormal SharePoint download online, on a file server or even a volume exceeding 1GB of data through a VPN connection which indicates that a lot of documents are leaving the company.
When Paul , the hacker, accesses the corporate network through Laura's account to extract sensitive data, Martin detects and blocks it.
In addition, if Laura downloads a lot of documents, Martin is informed and can notify her in order to prevent company content from ending up on her personal computer and Paul accessing it.
Insider Threats # 3: Elevation of Privilege
Laura , the employee, uses the company's cloud platform much more frequently now.
Problem : sensitive data is exposed in MS TEAMS (Example) without control over the actions that can be done with it. She can invite other colleagues or external guests to teams without taking precautions as to whether they have the right to access them.
Martin , the IT manager, controls the access of users and members of access groups in his active directory.
With Netwrix Auditor for Azure AD, it can easily detect users who have been granted elevated access to data, revoke that access, and inquire whether they should really have permanent or temporary access to that data.
When Laura adds members to her team to share content with them and more, Martin makes sure that only authorized content is found there.
Insider Threats # 4: Unauthorized Activity Levels
Laura , the employee, works from home and feels alone in the world with no one looking after her.
Problem : She can search all over the network and try to access places where she shouldn't normally. It's a matter of time before she accesses data that she shouldn't Complete security.
Martin , the IT manager, normally has only a limited amount of abnormal activity to monitor and in his own way. At the moment he is on a small team with a higher workload.
With Netwrix Auditor for AD, Azure AD, Windows Server and File Server , it can easily identify abnormal levels of activity and affected users in order to take immediate action (detect, investigate and resolve), to prevent data from being accessed by users not entitled to it.
When Laura tries to gain access to data to which she does not have the right, Martin can notify her quickly and she will understand that even if she is at home, she cannot do what she wants.
# 5 Insider Threats: Unauthorized access to data.
Laura , the employee, works from home and feels alone in the world with no one looking after her.
Problem : She can search all over the network and try to access places where she shouldn't normally. It's a matter of time before she accesses data that she shouldn't.
Martin , the IT manager, normally only has a limited amount of unauthorized access to monitor and in his own way. At the moment he is on a small team with a higher workload.
With Netwrix Auditor for AD, Azure AD, Windows Server, File Server and DATA Classification , it can easily validate whether only authorized users have access to sensitive data and quickly detect unauthorized access and what activity has been done with it. .
When Laura tries to gain access or accesses data to which she does not have the right, Martin can verify what she has attempted to access or has done with it. He can take action with confidence on these events.
# 2 external threats: server security
Paul , the hacker, obtains the keys to the castle by taking advantage of security breaches on the web servers.
Problem : Web servers that have not been upgraded with the latest patches represent entry points that bypass the security restrictions in place.
Martin , the IT manager, is very busy making sure his ADFS, VPNs, Proxy servers are all working together right now.
With Netwrix Auditor for Windows Servers, it can take a maximum of 10 minutes to see if a server needs a security patch and identify the inherent risk for that patch. It also records activity on a server from start up to shutdown as a video, allowing you to see what would have been done on a compromised server.
When Paul tries to find a loophole to enter, he finds none, as Martin identified the one that needed to be fixed quickly, which was a high risk to his business.
# 3 external threats: elevation of privilege
Paul , the hacker, once he enters the network, he must elevate the privileges of the account he compromised to allow him to carry out his attacks.
Problem : give the hacker a lot of time so that with his efforts, he finds a way to settle in your environment.
For Martin , the IT manager, it's hard to keep an eye on all the activity on his AD, especially these days when there are a lot of changes caused by telecommuting.
With Netwrix Auditor for Active Directory, it can detect when someone is added to a critical group, target a user who is temporarily part of a privilege group, a user who is created in Azure AD and deleted before AD Connect replication and then quickly investigate these events.
Martin quickly detects Paul's actionsin his network and quickly blocks access to him and prevents him from causing damage.
# 4 external threats: ransomware
Paul the hacker sits quietly in his basement waiting for his "ransomware-on-demand" to start its attack.
Problem : There is always a chance that an employee will allow ransomware included in phishing or other tactics that Paul uses to get one into the company network with all these new doors open for telecommuting.
For Martin , ransomware is still a threat, but he has so much to do, with a small team he has prioritized some things more than others right now.
Together with Netwrix Auditor for Windows Servers and other modules , it can detect when an abnormal volume of files are read, modified or deleted and contain the threat. And with automated responses, fix things quickly.
Martin can continue to prioritize user services because when Paul installs his ransomware, it is detected and automated measures prevent it from causing harm.
# 5 external threats: compromised user accounts
Paul , the hacker, aims to get doors opened through accounts he has compromised, as they allow him to access data.
Problem : Experienced hackers know how to go under the radar for a long time which allows them to take their time finding data they can steal.
For Martin , the IT manager needs to focus his efforts on the activities that really require his attention and filter these out of all those that arise.
With Netwrix Auditor and Netwrix Data Classification , it can prioritize high-risk users who request immediate investigation. It can easily shed light on activities related to sensitive data.
Martin quickly spots the users Paul compromised in his risk dashboard and remedies the situation immediately.
These are just a few things that Netwrix can help IT professionals with during this time, but also at all times. It is offered as an annual module or as a monthly per user formula including several modules.
DANSLENUAGE.QUEBEC can set up Netwrix for or with you as well as carry out a pilot project, contact us now for more information!
Comments
Post a Comment