As I type this I’m surfing the cumulus on a plane destined for Boston, with a true 30,000 foot view of the city beneath me, packed in like a sardine and trying to type in a space unfit for normal size laptops, let alone humans.  The subject on my mind today:  User Activity Monitoring.

The challenge increasingly being voiced by customers and prospects throughout my travels in IT security circles is the need to understand, or at least have access to understand, ‘Who is doing what in our environments?”  In general our demand is to be empowered to quickly and easily tie an Identity to an Event.  Given the continued complexity of our IT infrastructures and the increasing number of disparate applications used to access tools and resources — all geared to support our business needs — how are we able to effectively get our arms around events of interest to alert, investigate, and report on user activity?  To get a picture of user activity do we need to manually review these records of activity across the environment in a bunch of individual data silos?  Hopefully not, particularly when time and resources are limited and the risk may be high.

The 30,000 foot view analogy is fitting for the value provided by deploying an enterprise log management and SIEM solution.  It is critical to be able to holistically view activity that spans across our business eco-system to effectively understand the ‘What’ and the ‘Who’ from a single pane of glass.  The ability to do that begins with log data normalization.  Normalized log data across disparate systems provides immediate visibility into user activity, allowing an analyst to quickly and efficiently zero in on potentially significant events of interest such as any ‘user added to group’, ‘account locked out’, ‘account created’, ‘document printed’, and ‘data copied to a usb drive’, regardless of the monitored device (Active Directory, Database Audit Records, VPN devices, Proxies, *Nix Systems, DLP devices, etc.).

Question: Okay, so now what does this information get me?  Answer: Knowledge.

Let’s take a real world use case.  Caleb’s a privileged user in your enterprise, he suddenly walks out the door, and has no intention of returning.  With a couple of simple, forward-thinking moves he could easily re-gain access to my environment.    He knows we will lock down his access to our corporate environment immediately after his departure.  So prior to leaving, he creates a new backdoor user account, gives that account privilege access, attaches VPN capabilities to the new account and voila, Caleb has unfettered access back into your network…all with no hacking required.  To proactively catch this, Log and SIEM vendors working with normalized log data should be able to alert you anytime users are added to privileged user groups.  Moreover, as a due diligence measure, you should be empowered  to quickly understand the past behavior of a privileged user during the termination process to understand what activity that user did prior to departing the company, including what accounts he created, what he printed, copied, deleted, accessed, created, etc., across the entire heterogeneous environment…

…and this is just the tip of the iceberg.  Normalizing log data across the enterprise places a tremendous amount of immediate visibility into the hands of the security engineer, but additional data enrichment can provide invaluable context surrounding events.  The next question is “How can log management and SIEM help you move from that 30,000 foot macro view across the enterprise to a 1″ micro-level view with fluidity?”   I’ll have to save that for another topic – right now it’s time to shut down all portable electronics and laptops in preparation for landing…