Log Management Features
|
 |
|
|
|
 |
|
 |
Defending and Monitoring Enterprise wide USB Storage Devices |
|
Monitoring Windows Workstations - Seven Most Important Events |
|
USB Monitoring
Over the last few years the use of USB storage devices such as flash-drives, iPods and cell-phones has exploded in corporate networks. The reasons are simple: they are cheap, incredibly convenient and useful tools to store and move data from machine to machine, and from home to the office. The proliferation of these devices however has opened up an entirely new security hole in the corporate network.
Much of the more serious theft of corporate data is now from internal sources and a very easy method to accomplish this is by utilizing USB drives to quickly copy confidential data. How do you prevent your confidential data from getting copied onto these drives and then removed from your location? This operation can often take just seconds and can be done from a desktop so physically limiting access to the servers is not complete defense. USB activity is especially critical on desktops - a network of a thousand workstations potentially opens a thousand doors for critical data to be removed through.
Until now the general approach to USB devices has been either of two unsatisfactory options: Shut USB's down entirely, or simply ignore the problem. Neither option is desirable, the first cuts substantially cuts productivity and makes the user community distinctly unhappy, while the latter is simply a security breach waiting to happen.
With EventTracker's USB monitoring there is now a third, more effective method to manage USB storage devices: Trust but Verify. EventTracker provides advanced monitoring and analysis of the usage of these devices including:
- Track Insert/Removal
- Record all Activity (file writes to)
- Disable according to predefined policy
With EventTracker you can easily set up policy that permits only certain devices in the control of IT staff to be used on critical Servers, while on Workstations you simply monitor all activities. Your users still have the convenience but the activity is now auditable, and your servers are far more secured and locked down. You can alert in real-time on the insertion of the devices, and/or record the files a user is writing to the USB.
Included in the EventTracker Reports Engine are pre-packaged reports that can display all USB activity – who the user was, what type of device was used, and what files they copied to the device. A complete inventory is captured that can be used for real-time analysis as well as a powerful forensic tool. Further, this advanced feature of EventTracker is not an added cost item, but is included in each EventTracker agent and is standard in all EventTracker editions.