User Risk Monitoring Vs Activity Monitoring Vs Session Monitoring

Hello everyone and welcome to Top Secret.

We have Sean Ofeer. Hi guys.

And I'm Baz Fisher. And today's topic is going to be what is the difference between user risk monitoring, user activity monitoring and user session monitoring. So let me ask you, Sean, can you sort of define those three different sorts of monitoring and what they actually mean?

Yeah, absolutely. So we can, I think we can, if we wanted to refer to the real life examples, we can look at normal CCTV so we can find CCTVs everywhere, in parking lots, on the streets, almost in every corner. And the cctv, its main purpose is to capture and record everything that's happening. So if something happened, if there is any investigation going, take for example the police, if something happened, an accident or something in that that perimeter, the footage can be useful for investigation. However you need to know and you need to replay hours of footage to find the exact incident.

That's true.

When you talk about user activity monitoring, you take the same cctv, but that CCTV also index everything that happens. So it captures the footage, but it says exactly what cars we see, what colors we see, where the people are going, what, what jackets they're wearing. So it index all the details. So not only that we have the footage, but also we have the details so we can actually search by specific elements. When we talk about user risk monitoring, that's something else. This is the footage with all the index, so we have all the facts, but we have also some context. So for example, when you, when we look at our babies, we see them, we watch them doing certain actions, these are actions. Our mind digests all these actions into a pattern which we can call it a behavior. So user risk monitoring is looking at all the actions, all the activities, but on a higher level to understand the context and the pattern of these actions, to determine whether there is a risk, whether it's intentional, unintentionally, it doesn't matter at the moment. But we can assess people behavior. I think that's the main purpose of using devrism.

So from a digital context, because I think what you've explained is great from a sort of behavior outside, but from a technology context, when we talk about activity model, we're talking about the ability to gain details about what the user is doing, correct?

Exactly, exactly. So when we look at corporates, for example, they have their employees. Now these employees have privilege to access different systems and infrastructure and they are given a trust to do their job. They have access to different critical assets, critical infrastructure, and they have access to sensitive information. They are given the trust the beginning when they start a work. But it's difficult to understand on a daily basis what they're doing. If something has changed during their legitimate work, they that can pose a risk to the organization. Again, could be intentional or unintentional. It doesn't matter the fact that organization needs that capability to determine a user risk or a user cyber risk at any given moment.

Correct.

And that's the user risk monitoring to monitor the risk that people posing on the organization. That also enable, if we take it to a higher level, enable organization to predict the risk before it's happening. And that's the highest level and the best approach to protect against inside the threats or inside the risks.

So in some ways you've actually answered why monitoring is important. Did you want to add something to that? Look, why is continuous monitoring? Because we don't just want to monitor a point in time and say yes, we understand that situation for a day, but we don't need to do any more monitoring.

No, no. I guess when we want to understand people behavior. Behavior is a continuous mode monitoring. So you can't really determine a risk when you're looking at the person for one day. Some actions can be seen as very legit during the day. But for example, let's take a fraud for example. Fraud is being executed over time, long time. So these are a lot of legitimate actions that usually not flagged, are not flagged by any system. In fact the organization allow the users to do their actions. But a fraud can be determined on a long term, during a long term of observation and then we can see anomalies. You can't really determine anomalies based on one or two days, obviously. Yeah.

When would you use session monitoring?

Well, session monitoring usually I really compare it to cctv, record user sessions, record their digital actions and just forget it. So if something happen, we can go back in time to the footage and start to play sessions. In many organizations this is a ticking a box for compliance reasons, not really for proactive measures.

Yeah. Is there confusion in the market right now in terms of for example user behavior anomaly detection or user behavior entity as such, where what an organization is trying to do is capture and get a lot of information, metadata from different disparate systems and try and make heads and tails out of it. But the way we've talked about quite a bit is when you get, you know, if you're just focusing on logs and collecting logs from systems, then you're missing a critical part.

Absolutely, absolutely. And you know, whoever watched that video, think of your Laptop. So you, you give that laptop to someone to work, they and that laptop logs everything. Obviously you have the event viewer or if it's Unix, you have all the system logs and that these logs even are sent to a log repository or even your splunk, Arcsight or any other sieve. Now imagine that that person you gave the laptop to opened some applications, he opened some Excel spreadsheets, notepad, edit some files, maybe have a quick chat on Telegram or WhatsApp or Skype, sending some emails, writing some emails, maybe deleting some of the of the emails, maybe he regret of some words and then close all the windows and hand back that laptop to you. Can you really tell what just happened looking at all the logs? That's a major problem. This is a major challenge for organizations. Traditionally they took those same and log repositories, applications and systems to gather all the white noise that come from a lot of systems. Some of this noise is valuable, but most of the noise was designed. All these system logs was designed by developers for debug purposes, not really for us to understand what's happening. So these logs don't tell people story, it tells system story. And for understanding people story, we need a system that will collect people logs, not system logs. That's the main difference.

Oh yeah, and we've very much talked about the the whole idea that when you're getting logs, you getting the symptoms of what's happening, but not actually the root cause or the root problem of what's actually happening. So totally agree with you. Is there anything that maybe I should have asked, I haven't asked or is there a last thing that you want to add to this conversation?

I think it's not a question that you should have asked me. Is a question that each one of you should ask yourself. If you experience insider threat concerns or fears inside the risk issues, maybe experience a breach, think yourself, what are you doing today to understand people actions? What are you collecting, what data you are digesting to understand what people are doing and more even. I'll take it to the further what do you do to prevent it? So that's a good question and this is actually what we do. We help organization understand and predict the human risk before it even occurs. So that's the best impact prevention to businesses.

Excellent, Sean, with that look. Thanks again and we'll be in touch. Cheers.

Absolutely, cheers.