INSIDER THREAT SECURITY BLOG

Stealthbits is very excited to share a sneak peek of some of the enhancements available with the launch of StealthDEFEND 2.2, scheduled for November 5, 2019. The fact remains – organizations concerned about data breaches and the rising costs to remediate them, need advanced solutions to not only quickly identify, but automatically respond to an ever-increasing barrage of attacks and breaches. Please continue reading to review technical tips and aligning video tutorials of how StealthDE…

Oftentimes, helpdesk operators are given access to accounts with privileges covering a broad range of tasks. A better approach is to apply delegated permissions for the specific task in hand, and then to remove those privileges once the action has been completed. Stealthbits Privileged Activity Manager (SbPAM) can allow AD rights to be dynamically added to a helpdesk operator account at the point it is required. To do this you will need to create a new Activity. Step 1) Create a new…

Breaches are an everyday occurrence. IT security professionals work tirelessly to protect against attackers penetrating their organization’s IT infrastructure, but what about the malicious insider? Do you ever wonder if users in your organization are poking around where they shouldn’t be? An easy way to investigate, using out-of-the-box capabilities aligned with StealthAUDIT 9.0 and our Access Information Center (AIC), is to leverage the activity information available via Stealthbits Te…

The recent release of StealthAUDIT 9.0 brings a lot of new features and exciting improvements.  Among them, include enhancements and capabilities aligning to our Active Directory (AD) & Azure, Box, Dropbox, Exchange, File Systems, SharePoint, and Windows modules. We even introduced a new module for Oracle database auditing and compliance reporting which is very exciting for our users, enabling them to understand permissions, activity events, sensitive data and configuration related inform…

The start of Active Directory attacks, like LDAP Reconnaissance, involves finding vulnerabilities on a network and grabbing “intel” about sensitive accounts like Domain, Enterprise, and Schema Admins. After an attacker initially compromises a system on a network, they will pretty much have no privileges in the domain. This leaves an attacker hungry for more, and with the way Active Directory is designed, they can query objects inside a directory pretty easily. LDAP queries are key in an a…

Stealthbits Technologies’ most recent release, StealthDEFEND 2.0, brings with it a whole new suite of advanced threat analytics inside of Active Directory (AD). If you are already a user of StealthDEFEND, you are already aware of the great response and analytics it provides for file system monitoring by leveraging machine learning and user behavior analytics. Now, with StealthDEFEND 2.0, and the expansion into new threats and monitoring capabilities around AD, Stealthbits Technologies is uniq…

We recently released our “5 Cybersecurity Trends for 2019” covering a few of our technical experts’ opinions here at STEALTHbits. One trend is specifically around GDPR fines causing organizations to finally get serious about GDPR compliance this year. In this edition of our ProTip, I will walk you through how you can add in StealthAUDIT’s real-time analytics to Active Directory and File System data to enable reporting for these regulations. Our Vice President of Product Strategy, Rya…

Gain Visibility – How are Users Accessing Your Unstructured Data? Recently, STEALTHbits Technologies partnered with the Ponemon Institute to create a report on “The 2018 Study on the State of Data Access Governance”. The report highlighted and outlined the current state of Data Access Governance (DAG) in organizations, as well as the effect that it could have to reduce risk of exposure of confidential data. The findings are very interesting and I personally suggest you give it a read to comp…

In prior ProTips we have explored discovering sensitive data throughout the environment, managing access to that data and monitoring it. Today’s ProTip focuses on adding an additional layer of protection that protects sensitive data in the event of a Ransomware outbreak, or compromised credentials being used to steal data. Creating the Investigation First, we create an investigation that looks for users accessing sensitive data. There are several things that happen behind the scenes – f…

Here’s a quick way to identify accounts with bad passwords in your Active Directory (AD). If you’re running StealthAUDIT for Active Directory, this is a very effective yet low-effort way to eliminate compromised passwords from your domain. Finding the bad passwords: From your web browser, click through the report tree down to the Active Directory>Users section. The report you want is called ‘Weak Password Checks.’ One of the checks in this report performs a hash comparison between…