Access Auditing With Varonis

Transcription

1 Varnis Usage Example: Access Auditing CONTENTS Access Auditing With Varnis Overview... 1 Traditinal/Manual ApprachES... 1 Varnis Apprach... 2 Abut The Varnis Metadata Framewrk 5 Varnis Data Gvernance Suite... 6 Varnis DatAdvantage fr Windws Varnis DatAdvantage fr UNIX/Linux Varnis DatAdvantage fr SharePint...6 Varnis DataPrivilege...7 Varnis Data Classificatin Framewrk...8 Learn Mre...8 OVERVIEW Varnis DatAdvantage cntains detailed infrmatin n every file access event, stred in a nrmalized database that is easily searched and srted t answer questins such as: Wh has been accessing this flder? What data has this user been accessing? Wh deleted these files? Where did thse files g? TRADITIONAL/MANUAL APPROACHES Mst IT departments can t answer questins abut what actually happened t files wh accessed them, deleted them, mved them, where they went, etc. This is because native windws auditing is resurce intensive, vluminus, and cryptic, and therefre rarely enabled. T enable native windws auditing fr file access, first activate audits f successful bject access attempts via the lcal r dmain security plicy settings. Next, each flder s auditing settings (knwn as the SACL) must be mdified t include thse users yu wish t audit. These are enabled in Prperties->Security->Advanced->Auditing. If yu want t audit all access events by everyne, add the everyne grup, and select Success>Full Cntrl. Once auditing is enabled, events will shw up in the security event cntainer. The events must be pened up individually t inspect their cntents, r exprted. They are difficult t decipher, but nt impssible. There is sme filtering ability if yu knw which user yu re interested in, but nt fr directry name, file type, delete events, etc. Enabling auditing n Slaris requires making use f the BSM Security Auditing cmmand, bsmcnv. Reading the results requires utputting them with the cmmand, auditreduce. Linux 2.6 Kernel auditing invlves cnfiguring auditd, and using the cmmand, ausearch t analyze the results. Varnis Usage Example: Access Auditing Varnis Systems, Inc. 1

2 Varnis Usage Example: Access Auditing VARONIS APPROACH Varnis des nt require windws auditing, BSM, r Linux 2.6 Kernel auditing t be enabled; Varnis has written a file system filter t capture these events n windws servers, Slaris, and Linux servers. The filter cnsumes negligible CPU time and RAM, and des nt write t disk n the mnitred systems. Varnis als cllects audit infrmatin frm SharePint, EMC Celerra, and Netapp filers. (Fr Netapp filers and EMC Celerra DataMvers, Varnis uses their native perating system mechanisms fplicy n Netapp, CEPA r Windws analg auditing n Celerra). Access activity is aggregated, nrmalized, analyzed, and stred in the Varnis Metadata Framewrk, and is accessible via the Varnis DatAdvantage and DataPrivilege Interfaces, and reprts. The DatAdvantage GUI allws yu t search by directry, by user, by grup, by file type, by activity type (pen, create, delete, mdify, mve, etc.), and mre, with virtually unlimited cmbinatins, as well as and/r grupings. Fr example, t determine wh has deleted data in a directry, simply duble click the directry, grup by Operatin type, and expand the Object Remved Events t see a list f all file delete events: Varnis Usage Example: Access Auditing Varnis Systems, Inc. 2

3 Varnis Usage Example: Access Auditing T see what a user has been accessing, just duble-click n the user: Events can be examined in greater detail by duble-clicking: Once yu find what yu re lking fr yu can exprt it right t Excel frm Tls>Lg>Exprt t Excel. Varnis Usage Example: Access Auditing Varnis Systems, Inc. 3

4 Varnis Usage Example: Access Auditing The secnd methd is t simply run ne f the Varnis DatAdvantage built-in reprts, User Access Lg, specifying a user r grup, flder, file, r any cmbinatin f numerus available parameters. This reprt (as with all DatAdvantage reprts) can be run n demand, r scheduled t run and be delivered via r share distributin autmatically. The utput lists detail fr each file access event: Varnis Usage Example: Access Auditing Varnis Systems, Inc. 4

5 Varnis Usage Example: Access Auditing ABOUT THE VARONIS METADATA FRAMEWORK Onging, scalable data prtectin and management require technlgy designed t handle an everincreasing vlume and cmplexity a metadata framewrk. Fur types f metadata are critical fr data gvernance: User and Grup Infrmatin frm Active Directry, LDAP, NIS, SharePint, etc. Permissins infrmatin knwing wh can access what data in which cntainers Access Activity knwing which users d access what data, when and what they ve dne Sensitive Cntent Indicatrs knwing which files cntain items f sensitivity and imprtance, and where they reside The Varnis metadata framewrk nn-intrusively cllects this critical metadata, generates metadata where existing metadata is lacking (e.g. its file system filters and cntent inspectin technlgies), pre-prcesses it, nrmalizes it, analyzes it, stres it, and presents it t IT administratrs in an interactive, dynamic interface. Once data wners are identified, they are empwered t make infrmed authrizatin and permissins maintenance decisins thrugh a web-based interface that are then executed with n IT verhead r manual backend prcesses. The Varnis Data Gvernance Suite will scale t present and future requirements using standard cmputing infrastructure, even as the number f functinal relatinships between metadata entities grws expnentially. As new platfrms and metadata streams emerge, they will be seamlessly assimilated int the Varnis framewrk, and the prductive methdlgies it enables fr data management and prtectin. Varnis Usage Example: Access Auditing Varnis Systems, Inc. 5

6 Varnis Usage Example: Access Auditing VARONIS DATA GOVERNANCE SUITE Varnis prvides a cmplete metadata framewrk and integrated prduct suite fr gverning unstructured data n file servers, NAS devices and (semi-structured) SharePint servers. Varnis DatAdvantage, DataPrivilege, and the Data Classificatin Framewrk prvide rganizatins the ability t effectively manage business data thrugh actinable intelligence, autmatin f cmplex IT tasks, and sphisticated wrkflw management. Varnis DatAdvantage fr Windws Varnis DatAdvantage fr UNIX/Linux Varnis DatAdvantage fr SharePint DatAdvantage prvides a single interface thrugh which administratrs can perfrm data gvernance activities. Visibility Cmplete, bi-directinal view int the permissins structure f unstructured and semi-structured file systems: Displays data accessible t any user r grup, and Users and grups with permissins t any flder r SharePint site User and grup infrmatin frm directry services is linked directly with file and flder access cntrl data Cmplete Audit Trail Usable audit trail f every file tuch n mnitred servers Detailed infrmatin n every file event in a nrmalized database that is searchable and srtable Data cllectin perfrmed with minimal impact t the file server and withut requiring native Windws r Unix auditing Recmmendatins and Mdeling Actinable intelligence n where excess file permissins and grup memberships can be safely remved withut affecting business prcess Mdel permissins changes withut affecting prductin envirnments Data Ownership Identificatin Statistical analysis f user activity effectively identifies business wners f data Autmated reprts invlve data wners in data gvernance prcesses Facilitates rund-trip data wner invlvement via DataPrivilege Varnis Usage Example: Access Auditing Varnis Systems, Inc. 6

7 Varnis Usage Example: Access Auditing VARONIS DATAPRIVILEGE DataPrivilege autmates data gvernance by prviding a framewrk fr users and data wners t be directly invlved in the access review and authrizatin wrkflws. A web interface fr data wners, business users, and IT administratrs autmates data access requests, wner and IT authrizatin f changes, autmated entitlement reviews, and business data plicy autmatin (e.g. ethical walls). A cmplete audit trail ensures that data gvernance plicies are in place and being adhered t. Autmated Entitlement Reviews Data wners are prvided scheduled entitlement reviews with recmmendatins fr access remval (generated by DatAdvantage) Reviews can be scheduled based n business plicy Access Cntrl Wrkflw Users can request access t data and grup resurces directly, prviding explanatin and duratin Data wners and ther stakehlders are autmatically invlved in authrizatin prcess Permissins changes are carried ut autmatically nce apprval requirements are met Permissins revcatins are carried ut autmatically n their assigned expiratin Business Plicy Implementatin Multiple levels f authrizatin prvide autmated implementatin f business and IT data gvernance plicy Ethical wall functinality enfrces data access plicies Cmplete Self-Service Prtal Data Owners can view and manage permissins n their data and grups withut requiring elevated access privileges, if desired Data Owners can view access activity and statistics abut their data, if desired Cmplete Audit Trail and Reprting All wrkflw events are recrded fr audit and reprting which can prve the enfrcement f gvernance practices Authrizatins, Entitlement reviews, and ther management reprts prvide evidence f prcess adherence Varnis Usage Example: Access Auditing Varnis Systems, Inc. 7

8 Varnis Usage Example: Access Auditing Varnis Data Classificatin Framewrk The Varnis Data Classificatin Framewrk gives rganizatins visibility int the cntent f data, prviding intelligence n where sensitive data resides acrss its file systems. By integrating file classificatin infrmatin frm either the included classificatin engine r frm a third-party classificatin prduct alngside the rest f the Varnis metadata in the DatAdvantage interface, DCF enables actinable intelligence fr data gvernance, including a priritized reprt f thse flders with the mst expsed permissins AND cntaining the mst sensitive data. Actinable Intelligence Classificatin infrmatin prvides visibility int business-critical cntent frm within the Varnis IDU Organizatins can see where their mst sensitive data is ver-expsed alng with actinable recmmendatins n where that access can be reduced Extensible Architecture The prvided data classificatin engine prvides a pwerful and flexible methd fr classifying sensitive data thrugh regular expressins and dictinary searches. The Data Classificatin Framewrk can als integrate cntent classificatin data frm third-party classificatin and DLP prducts, extending the ability f bth Intelligent, fast True incremental scanning is attained with DatAdvantage real-time knwledge f all file creatins and mdificatins nly new data is classified Prduces rapid-time-t-value results that have a clear remediatin path r next step Prduces results dramatically faster than traditinal appraches Leverages existing infrastructure Can use either its built-in classificatin engine r thse already deplyed Uses the unique meta-data layer created by the Varnis Intelligent Data Use (IDU) Framewrk Builds n the fundatin f the Varnis IDU Framewrk, with n need fr additinal servers r strage Results flw int Varnis DatAdvantage and Varnis DataPrivilege (future) Easy, pwerful classificatin rules Rules match a cmbinatin f cntent AND meta-data cnditins (e.g. creatr, accessing user, permissins sets) Priritizatin based n Varnis metadata (e.g. scan the mst expsed flders first) Files are searched fr keywrds, phrases and/r regular expressin patterns Dynamic/aut-updated dictinary matching capabilities Learn Mre Phne: sales@varnis.cm Varnis Usage Example: Access Auditing Varnis Systems, Inc. 8