Zastosuvannya Windows Audit for inspecting the validity of koristuvachiv. Infowatch software and support solutions Change ideas for the integrated system

Abstract: At the conclusion of the lecture, there are some other recommendations. technical assistance to the owner of the confidential information, the characteristics and the principle of the robot are examined in detail, the InfoWatch solution

InfoWatch software solution

By the way, given the course, it is not є the lecture about the technical details of the robotics of InfoWatch products, which is understandable from the side of technical marketing. InfoWatch products are based on two fundamental technologies - content filtering and auditing for a koristuvach or an administrator on a work mission. Also the InfoWatch integrated warehouse solution є the information system, which has overflowed the information system and the same control console for the internal safety.

Content filtering of channels

The main view of InfoWatch content filtering is the registration of the morphological core. On the basis of the traditional signature filtering, the technology of content filtering InfoWatch can change a lot - insensitivity to the elementary coding (replacing some symbols for inspiration) and productivity. Oskіlki kernel pratsyuє not with words, but with the root forms, it will automatically lead to the root, like to take revenge on the code. Similarly, a robot with roots, which are less than ten thousand in skin mov, and not in word forms, which are close to a million, allowing to show significant results to reach unproductive possession.

Audit diy koristuvachiv

For the monitoring of documents on the InfoWatch workstation, a number of overpicks are sent to one agent at the workstation - file operations, operation to a friend, operations in the middle of preparatory operations, operations

The information system has been overlaid on the information system on all channels.

The InfoWatch company has promoted the information system, which has overloaded the information system. Documents that have passed through all channels, which lead the name systems - electronic mail, the Internet, other devices, are stored in a supplement * storage (until 2007 - the module Traffic Monitor Storage Server) from the values ​​of the attributes - PIB and the posad of the corystuvach, his electronic projections (IP-addresses, the field record or the mailing address), the date that the operation was opened, and the attributes of the documents. All information is available for analysis, including content.

Suputnі dії

In the provision of technical assistance to the confidential information manager, they are ineffective without the registration of the other methods, in front of the organization. The deeds of them were already visible. We are now submitting reports on any necessary activities.

Porushnik behavior models

Having opened the monitoring system for confidential information, in addition to increasing the functionality and analytical capabilities, it is possible to develop in two ways. The first is the integration of systems to resist from internal and external threats. The incidents of the rest of the rock show that the role of the internal and the called evil men and the sharing of information from the systems to the monitoring of external and internal threats to allow such threats from the internal and internal threats to the threats of such threats was generated. One of the points of view of the external and internal security is the management of access rights, especially in the context of simulation of the robust need for the improvement of rights by disloyal warlords and saboteurs. Whether applications for rejecting access to resources, which are not transferred by service connections, are guilty of inaccurately turning on the audit mechanism for the information. Even more secure visibility of the service, with the rapid success rate, access to the resources without any notice.

Guided butt from life. The system administrator received an application from the head of the marketing department for access to the financial system. How the application was structured was applied by the Director General's manager for the marketing and advancement of the processes of purchasing goods, such as the company. Oscillations of the financial system - one from the most protected resources and called for access to it, yes, the general director, head of the department information security on the application, writing an alternative solution - do not give access, but vivantage to a special basis for the analysis of anti-isolation (without requesting clients) data. In the opinion of the head marketer's remarks about those who are not so successful, the director has put food "on the forehead": "Now, to name the clients - do you want to anger the base?" -for whom all went pratsyuvati. It’s easy to organize the information, the minutes aren’t known, but it’s not, the corporate financial system is stolen.

Zapobіgannya turn on the stage of preparation

I went directly to the development of the system and monitoring of internal incidents with the confidential information - to stimulate the system and to prevent the loop. The algorithm of the robot is such a system and the one that the solutions have to prevent intruders. The collection will be a model of a porner, it will form a "signature of a destructed", that is, the end of the deed. As soon as the kolka diy koristuvach was scored with the signature of the destructive, the onset of koristuvach was predicted, if the koristuvach was defeated with the signature, the alarm signal would be given. For example, when a confidential document is issued, a part of the document is seen and copied to the buffer, then it is written new document and up to new buckets are copied instead of the buffer. Transmission system: any new document will be saved without a "confidential" tag - the process of stopping it. A USB drive has not yet been inserted, a sheet has not been molded, but the information system of the officer is not safe, which is a solution for a spider-man or a quilt, where the information is. Prior to speech, models (in some dzherels - "profiles") the behavior of a porcine can be victorious, not without the information being collected from the software agents. As soon as you analyze the nature of the power supply to the base of the data, it is possible to see the sportsman, as the order of the last power supply to the base, you can correct the specific information. It is necessary to just sit down right there, how to rob it from the power supplies, what is it, what is the key to changing information and information.

Organizational information collection

Principles of announcing and ciphering of dues - the observance of the mind for organizing the collection and processing, and add-on access It is possible to organize for the thermal protocol, without being overloaded on computers, for organizing the power supply, and for information.

Integration with authentication systems

It is early for the deputy to be informed about the monitoring system with the confidential documents for the administration of personnel food - for example, the sound of the workers on the basis of the facts, documented by the whole system for the purpose of determining the ship transportation Protect everything that can be monitored by the system - the electronic identifier of the attacker - IP-addresses, regional recording, e-mail addresses and addresses If you can legally call a spyvrobitnik, it is necessary to bind an identifier to an individual. Here, in front of the integrator, there is a new market - a test of authentication systems - from the simplest tokens to the inserted biometrics and RFID - identifiers.

In the need for the provision of audit systems and audits for organizations of any kind to reconnect the previous companies that are engaged in the analysis of information security.

The pre-release of Kaspersky Lab, for example, showed: two thirds of IB-incidents (67%) wikklicans, zokrema, some nasty informal or unimportant sportsmen. According to ESET's data, 84% of companies underestimate the risks of being surprised by the human factor.

Zachist from the threats, tied from the middle of the middle, to the greater zushil, not to the victor from the outward threats. For anti-school students, including viruses and targeted attacks on the organization's edge, it is enough to secure a separate software or hardware-software complex. In order to ensure the organization of the internal malevolent, the need for serious investment in the infrastructure is safe and the conduct of a great analysis. Analytical robots include seeing the types of threats that are most critical for business, as well as the creation of "portraits of porters", so as to designate some of the smugglers that can be used for their own competence.

With the audit, it’s not unreasonable to tied up the corystirists, it’s not without reason, that the “break” in the information security system needs to be quickly closed, and the food has become a business. Companies that have been set up for uninterrupted activity are responsible for the acceleration and improvement of the processes of informatization and automatization of business.

In addition to the development of a transnational worker, it is necessary to conduct an audit of the operations of "super-corrosives" - sportsmen with the privileged rights and, apparently, by the wide possibilities of the form, and in a way that can help to realize the threat of threats. System administrators, administrators of databases, vendors of internal software security are referred to such koristuvachіv. It is possible for people to receive and receive IT-faculty members, and sportsmen, who are candidates for IB.

Providing the system and monitoring of the employees of the company allows them to quickly respond to the activity of workers. Importantly: the audit system is responsible for the power of inclusiveness. The price means, about the activity of an ordinary sportsman, a system administrator, or a top manager, it is necessary to analyze on the operational system

The current systems and complex audit allow the control of all stages of the process of starting up to the activation of the PC (terminal workmanship). Shchepravda, practical total control magayutsya unique. Also in the logs the audit of all operations is carried out, the growth of baggage growth is added to the infrastructure of the information system and the organization: to "hang" the work stations, the servers and channels to work with the new employees. The paranoia of nutrition and information security can help our business, meaningfully trusting the work processes.

Competent specialist with information security for us in advance of the appointment:

• the company has the most valuable gifts, and there will be a large number of internal hazards associated with them;
• you can get access to valuable dues for any kind of money, so that you can surround some potential porters;
• Once in a row, come in to the owner of the building protist to see that / abnormally vypadkovy diam koristuvachiv.

For example, the IB-fahivtsi from the financial sector vvazhayut the most dangerous and dangerous to the round of payment tributes and icky access. The industrial and transport sectors are most afraid of the rounds of know-how and disloyal behavior of the workers. Avoid fighting the IT sphere and telecommu nication business;

In the capacity of the most common "typical" porters ANALYTICS SEE:

• Top management: Vibir obvious - the widest possible, access to the latest information. With a great number of reasons for security, it is often the case that such figures are broken for the violation of the IB rules.
• Disloyal workers : to determine the level of loyalty to the IB-faciers of the company, conduct an analysis of the okremogo sportsman.
• Administrator: specialties with privileged access and expanded new ones, as there may be more knowledge in the IT sphere, important information;
• Spyvrobіtniki fіdryadnyh organіzatsіy / outsourcing : as і administration, experts "zzovny", volodyuchi by wide knowledge, can realize the risk of contamination, overburden "all the middle" of the information system and the deputy.

The designation of the most significant information and the newest malevolent agents helps to create a system of not total, but vibrational control of coristors. Tse "rozvantazhu" information system that relieves the IB-factions of the overworldly robots.

In addition to vibrating monitoring, I have a role in the accelerated robotic system, in advancing the quality of analysis and reducing the cost of the infrastructure, in the architecture of audit systems. Suchasnі systems and audits dіy koristuvachіv mayut rozpodіlenu structure. On the end-of-line workstations and servers, the agent-sensors are installed, which analyze the same type and transfer the data to the center of consolidation and protection. The system for the analysis of the recorded information from the settings of the system with the parameters to know in the audit logs the facts of anomalous activity, as it is possible to immediately register before the implementation of the problems. The facts are transmitted to the system and the response, as it helps the administrator to be safe about the damage.

If the audit system is built independently to cope with the damage (call on the base for transmission of signatures to respond to the threat), then the failure to revert to the automatic mode, and all you need to see a special house for the loser The administrator's console is safe for such a time, because of the problem of foreign affairs.

If the system does not have a way to automatically respond to the suspicion of activity, then all information for neutralizing the contamination or the analysis of the inheritance is transferred to the administrator's console of the IB before the operation mode is displayed in the manual mode.

MONITORING SYSTEMS HAVE BEEN-YAKI ORGANIZATSIЇ SLID NALASHTUVATI OPERATIONS:

Audit of work stations, servers, as well as an hour (in the same days) the activity of a koristuvach on them. In such a way to establish the pedagogy of information resources.

In some cases, they can take a trip, as they are sent from us to the power supply "Who is it?" It can also be seen "born, ale vluchno"

Practically everywhere, there are project reports, accountants, vendors and other categories of workers, which can work over groups of documents, so that they can be stored in remote access (Shared) robots on a file server on a file server It might be like that, when you see an important document, or the director from the folder, in the meantime, the work of the whole team may be involved. At such a time, before system administrator vinikak kilka power supply:

If that has a problem?

From what time to the nearest hour backup copy next update of the date?

Maybe, buv a systemic zby, how can I repeat it again?

Windows є system Audit, I will allow you to display that journalistic information about those, if you have seen any documents behind the help of any programs. For reasons, the Audit is not a problem - it is a step by itself in the form of a system, and if you write down all the steps, then it will become great. Tim is bigger, far from all of the children can help us, so the Audit policies allow us to conceal all the quiet, but for us it is just important.

The Audit system is installed in all Operating systems MicrosoftWindowsNT: Windows XP / Vista / 7, Windows Server 2000/2003/2008. It is a pity that Windows Home systems have an audit trail of captures, and they can be fine-tuned.

Would you like to set it up?

Check out the audit, go with the administrator's rights to the computer, if you need access to the background documents, then visit the command Start→Run→gpedit.msc. Open the folder in the Computer Configuration folder Windows Settings→ Security Settings→ Local Policies→ Audit Policies:

Two click on politics Audit object access (Audit access to ob'єktіv) check the box Success. The whole parameter includes the mechanism of the step for successful access to the files in that register. Really, even if you don't want to see us files or folders, you're far away. Umknit Audit is deprived of computers, without the need for any objects, which are available.

The simple inclusion of the policy is not sufficient for the audit, we are also responsible for providing access to certain folders. Name such objects є folders of foreign documents, which are distributed, і folders with virobnichny programs or databases (accounting, warehouse too) - tobto, resources, with the help of some special ones.

Late in guessing, hto saw the file itself, it’s not a matter of fact, it’s hard to try for everything (Everyone). Try to see the objects, how to see it, if it’s like a bummer, it will be entered in the journal. Viklichte the power of the required folders (if there are such folders, then all of them are by default) and on the bookmarks Security → Advanced → Auditing give a piece for a sub'єkt Everyone (All), yogo successful access Deleteі Delete Subfolders and Files:

You can go to the magazine to finish the bagato, so it also goes to adjust the size of the magazine Security(Bezpeka), in which stench will be recorded. For
see the team Start→ Run→ eventvwr. msc. In vіknі, vіklіtіvlіstі to the magazine Security and to add the offensive parameters:

Maximum Log Size = 65536 KB(for working stations) abo 262144 KB(For servers)

Overwrite events as needed.

As a matter of fact, the figures are not guaranteed to be accurate, but are chosen by an appropriate way for a specific skin problem.

Windows 2003/ XP)?

Natisnit Start→ Run→ eventvwr.msc Security View→ Filter

• Event Source: Security;
• Category: Object Access;
• Event Types: Success Audit;
• Event ID: 560;

Take a look at the list of displayed pods, I will respect the following fields in the middle of the skin:

• ObjectName. The name of the shukano folder or the file;
• ImageFileName. Іm'ya programs, for the help of which they saw a file;
• Accesses. The set of power supplies is right.

The program can be accessed by the system and immediately by the number of types of access - for example, Delete+ Synchronize abo Delete+ Read_ Control. Important to us є right Delete.

Otzhe, hto have seen documents (Windows 2008/ Vista)?

Natisnit Start→ Run→ eventvwr.msc ta view the magazine Security The journal can be used for storing pod_yami, as a direct reference to the problem and not to blame. Pressing the right button on the Security log, vibrate the command View→ Filter and filter the view over the following criteria:

• Event Source: Security;
• Category: Object Access;
• Event Types: Success Audit;
• Event ID: 4663;

Do not be too late to interpret everything that is seen as evil. Qia function is often victorious in the presence of special robots of the program - for example, the victorious command Save(Take care) program package MicrosoftOffice copy a new time file, save a document, see what front version file. Likewise, a lot of database programs, when launching from the chat, open the time file blocking (. lck), then I see him when the programs are logged in.

I was brought up practically by sticking out and with the sinister actions of koristuvachiv. For example, a confidential spokesman for a company in the event of a robotic mission has seen all the results of his work, he has seen files and folders, up to which he has seen it. Podії of this kind are kind - the stench generates dozens, hundreds of entries per second in the logs are safe. Apparently, updating documents from ShadowCopies (Tinovikh Copies) for it is not a storehouse of special difficulties, which is automatically folded automatically into the archive, but at the same time I would like to go to the power supply "Who is it?" і "How much has it become?"

To conduct an audit, access to files and folders in Windows Server 2008 R2, you need to include the audit function, as well as specify folders and files, access to which you need to fiksuvati. After setting up an audit, the server log reveals information about access and submissions to vibran files and folders. Varto respect that the audit of access to files and folders can only be carried out on volumes using the NTFS file system.

Includes audit on file system objects in Windows Server 2008 R2

Audit access to files and folders are included and displayed for help group policies: domain policy for the Active Directory domain or local policies are safe for servers, so it is ok to stand. If you want to enable an audit on an external server, you need to open a management console local policy Start ->AllPrograms ->AdministrativeTools ->LocalSecurityPolicy... At the console of the local policy, it is necessary to fire a tree. LocalPolicies) ta vibrati element AuditPolicy.

On the right panel, you need to vibrate the element AuditObjectAccess and in the window of opportunity to access the files and folders it is necessary to use the file (successful / not far access):

Making the selection of the necessary adjustment is required Good.

Vibir files and folders, access to any files

In addition, since audit is active for access to files and folders, it is necessary to vibrate specific objects. file system audit of access to which will be conducted. Yak and allow NTFS to set up an audit for the candidates to settle down on all daughter objects (if the file is not configured). So, if the rights to access the files and folders are assigned, the audit can be turned on for everyone, or otherwise for vibrating objects.

To set up an audit for a specific folder / file, you need to click on the new right button and click the Power item ( Properties). For the authorities, you need to go to the Security tab ( Security) press the button Advanced... In the widened ones, they have no baked goods ( AdvancedSecuritySettings) go to the Audit tab ( Auditing). Nalashtuvannya audit, of course, requires the rights of the administrator. At all stages of the audit, a list of the groups will be displayed, for any inclusions the audit on the whole resource:

Schob dodati koristuvachiv or groupy, access to to this object If you fiksuvatisya, you need to press the button Add ... that vkazati imena tsikh koristuvachiv / group (or vkazati Everyone- for audit access for all koristuvachiv):

Immediately after reading the data, setting up the system logs Security (you can know it in the equipment ComputerManagement -> Events Viewer), with skin access to the objects, for those with an audit, there will be visible records.

Alternatively, you can take a look at the PowerShell cmdlet helper. Get-EventLog For example, let us introduce all the submissions from the eventid 4660, the viconamo command:

Get-EventLog security | ? ($ _. eventid -eq 4660)

Porada... On any page in the Windows logs, you can indicate the letters, for example, the power of the electronic sheet or the display of the script. How the price can be adjusted is described in the article:

UPD dated 06.08.2012 (Dyakuyu commentator).

Windows 2008 / Windows 7 has a special utility for keruvannya audit auditpol. Top list types of objects, on which you can turn on the audit, you can ask for additional commands:

Auditpol / list / subcategory: *

Yak vi bachite ci ob'єkti subdivided into 9 categories:

• System
• Logon / Logoff
• Object Access
• Privilege Use
• Detailed tracking
• Policy Change
• Account Management
• DS Access
• Account Logon

First, the skin of them is apparently distributed in the category. For example, the Object Access audit category includes a category File System If you want to enable an audit for the filesystem objects on the computer, the Viconamo command:

Auditpol / set / subcategory: "File System" / failure: enable / success: enable

Enter the window according to the command:

Auditpol / set / subcategory: "File System" / failure: disable / success: disable

Tobto. As soon as you get an audit of unnecessary pedagogues, you can quickly answer the magazine and a number of unnecessary podiyas.

In addition, as audit is active, access to files and folders is required, it is necessary to specify specific objects that will be controlled (at the authority of files and folders). Mayte on uvaz, so that the audit has been set up to settle down on all daughter objects (not specified in the first place).