BalaBit announces general availability of Blindspotter; advanced monitoring to identify suspicious user activity
BalaBit, an IT security innovator specialising in advanced user monitoring technologies, today announced that its next-generation IT security tool, Blindspotter, is now generally available. Blindspotter is a real-time, user behaviour analytics (UBA) tool that analyses user activities and identifies suspicious events occurring throughout IT systems. It is designed to help organisations mitigate the impact of advanced persistent threats (APTs) or identify malicious internal activity and to speed up the investigation process of any suspicious activity.
Blindspotter tracks and visualises user activity in real-time to provide organisations with a better understanding of what is really happening on the network. The solution works by collecting and analysing user-related events and user session activity in real-time or near real-time. It then compares every action to the corresponding baseline of users and their peers to spot anomalies in their behaviour – such as an administrator logging in outside of their normal hours. Blindspotter is even capable of detecting abnormality on the level of issued commands. This means that, if a system administrator uses a command that is different from the generally used command set, Blindspotter will alert the security team. Once this has been detected, Blindspotter can automatically react to minimise the impact of any threat.
It is designed to meet today’s key security challenges and alert organisations to key threats, for example:
Detection of hijacked user accounts
The activities of an attacker who has compromised a legitimate account will differ significantly from a normal user’s activity; external attackers will typically try to map the IT system by accessing various systems to probe for available services or download a large amount of data, which would be of value to them. Blindspotter is able to detect and alert security analysts to deviations of this kind.
Detection of misuse of privileges
Blindspotter can help to detect if a user with high privilege rights has attempted to steal company data or to copy or modify sensitive company data that is not required for his job. In this way the data breach can be prevented.
Detection of automated system account misuse
Automated system accounts are typically created by administrators to repeat regular tasks such as backing up the database or restarting certain services overnight. Automated system accounts increase the efficiency of administrators’ jobs, however, to make their job easier, in many cases they take a risk by using their own credentials. This is a security risk; in the event that the script is hacked, the attacker not only has the account details of the system administrator but also gains access to all the services that the administrator has. Using Blindspotter, it is possible to distinguish between accounts used by automated jobs and humans.
Screen Content Analysis
Used in conjunction with Shell Control Box – BalaBit’s privileged activity monitoring appliance – Blindspotter can also analyse screen content, including issued commands and applied software or any textual data that appears on the screen. This enables the detection of any anomalies, which are the obvious signs of an APT-attack or a serious misuse of privilege.
Commenting on the release of Blindspotter Zoltán Györkő, CEO of BalaBit said:
“The reality for most organisations is that security threats already lurk inside their perimeter, whether it’s a sophisticated external attacker who has gained access to an internal account or a malicious insider attempting to steal data.
In the past, spotting attacks from within the perimeter has been notoriously difficult. Blindspotter is designed to close this security gap, and protect critical data, without slowing down a business’s day to day operations.”
About BalaBit
BalaBit – headquartered in Luxembourg – is a European IT security innovator and a leading provider of advanced user monitoring technologies. It has sales offices in BeNeLux, France, Germany, Hungary, Poland, Russia, the United Kingdom and the United States, and partners in more than 40 countries. Its main development centers are located in Hungary. BalaBit has customers all over the world, including 23 Fortune 100 companies.
BalaBit’s new IT security concept – Contextual Security Intelligence (eCSI) – enables companies to use real-time analyzed monitoring information in security decisions, to increase business efficiency instead of over-controlling their users. BalaBit’s eCSI product portfolio uniquely covers key IT security needs including reliable Log Management, Privileged User Monitoring and User Behavior Analytics.
BalaBit, founded in 2000, has long track record as the developer of syslog-ng, the most popular open source log management tool with more than a million corporate users worldwide
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.