�ݺ�ߣ

Editor's Notes

• #5: Let’s talk about today’s security trends. I’ve been walking through the RSA show talking to the professionals. Here’s the hottest topics I’ve figured out during all my chats. It isn’t new but it’s in full swing. The vendors, the speakers at the conferences, the attendees still talk about the ransomware – it continues to be a hot topic, compliance regulations that don’t become any easier, and malicious insiders.
• #7: Just to continue talking about security trends I would like to share with you data from out IT Risks survey, that hasn’t been published yet, but I already have the data. We asked IT pros (including our customers), who do you think poses the biggest risk to your security? And 75% said “Insiders”, both employees and contractors, partners and outsources with access to internal content. This means that visibility into what your eligible users are doing becomes more and more important. We wanted to know, how Netwrix Auditor affects our users. At the beginning of this year we have published our customer survey, some of you may have participated, so thank you very much. This is invaluable information for all of us. Among all customers, 87% said that Netwrix Auditor helps them to maintain security policies, and almost a third said that they were able detect malicious activity and prevent a data breach at least once for the whole year. This feedback allows us understand that what we do helps you improve your security, which means that we are doing the right thing and encourages to develop further.
• #12: To know the enemy’s face, let’s see how the ransomware actually works and what its soft spots are. As said earlier, a user unintentionally opens a malicious file propagated via a compromised website or infected e-mail attachment and starts the payload delivery, thereby releasing a ransomware client. The ransomware client builds an SSL connection with a criminal's server and generates a public–private key pair to encrypt the victim’s files.  The ransomware client scans all physical and cloud-based drives for files with certain extensions. It copies and encrypts them (or not) and then deletes the original files (or not). The ransomware produced a dialog box with instructions for how the victim can pay a ransom to unlock the encrypted data.
• #13: The GDPR represents a hugely significant step in the development of privacy as a concept.   First, it is quite wide-ranging and will impact every organisation that processes European citizens’ personal data, regardless where it is located. Second, the GDPR penalties are extremely serious. Maximum fines for non-compliance are reaching €20 million, or 4% of worldwide turnover—numbers specifically designed to attract the attention of C-Suite members.   Third, the GDPR raises the bar for compliance significantly. It requires greater openness and transparency, imposes tighter limits on the use of personal data, and grants individuals more rights to stand their ground against organisations in case of data misuse. Meeting these requirements will be a serious challenge for many organisations.
• #14: You will hear these words a hundred times today, so let’s agree on what they mean.   Data Controller is the entity that determines the purposes, conditions, and means of personal data processing. Data Processor is the entity that processes data on behalf of the Data Controller. Here is an example of what a Data Process does: A utilities company engages a company which operates call centres to provide many of its customer service functions on its behalf. The call centre staff have access to the utilities company’s customer records for the purpose of providing those services but may only use the information for specific purposes and in accordance with strict, contractual arrangements. The utilities company remains the data controller. The company that operates the call centre is a data processor. Personal Data is any information related to a natural person or a ‘Data Subject’ that can be used to directly or indirectly identify the person. For example, a list of customer names and addresses will count as personal data, as may a database of customer email addresses.
• #15: Today, we’re going to focus on the next principles being the regulation base. These principles will be the core of your preparation.   Data security means protecting data from destructive forces and from the unwanted actions of unauthorised users. Controllers are responsible for ensuring personal data are kept secure and protected against accidental loss or damage. This principle is the centrepiece of the law itself; each and every article of the latter makes a reference to it in one way or another. The data accountability principle seeks to guarantee the enforcement of the data protection principles. The controller must demonstrate all necessary controls are in place. You should be able to say who’s doing what and why and quickly get an overall picture of a current systems and processes state. A timely response is the ability to react quickly and even foresee things. If a breach still occurs, controllers must notify affected data subjects and supervisory authority of such breaches in a short period of time. An audit trail is required for getting a comprehensive, accurate documentation of your systems. Following this principle and storing all of the information will enable you to reduce time spent searching for answers and give you a more holistic overview of the entire organization.
• #16: Don’t look for a single solution to help you pass the GDPR checks. It simply doesn’t exist. Start with building a holistic approach to your data security strategy. Netwrix Auditor is designed to help you with the list of articles from Chapter II and Chapter IV. Let’s discuss them in detail and see how Netwrix Auditor can support you.
• #17: Article 5 contains principles relating to processing of personal data, which shall be processed lawfully and fairly, collected for explicit and legitimate purposes, kept up to date, and so on. Its objective is quite clear – to protect personal data.   The first paragraph of Article 5 also requires personal data to be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, and appropriate use of technical or organisational measures (‘integrity and confidentiality’).   How can this be achieved? First, you should gain control over the access rights assignment to know who exactly has access to what data. Using report subscriptions, you can set an appropriate schedule for reviewing reports that show all user accounts with the current state of permissions granted to files and folders, current group membership, excessive access permissions, and changes to user permissions. Then you can compare these data with historical states stored in previous snapshots in Netwrix Auditor. Show reports o File Servers State in Time o Account Permissions o Excessive Access Permissions Show how to subscribe to certain reports Mention other reports: File Servers Activity o Permission Changes o User Activity Summary   Next, you can monitor what’s going on in your entire IT environment. Use the collected audit trail to review user access to sensitive content and data in SharePoint, Exchange, Exchange Online, Windows-based file servers, network-attached storage devices, databases, and other IT systems. In the appropriate reports, you will see all data manipulations that occurred in your databases or file shares. Show this: File Servers Activity File Server Changes by Action Oracle Database -> Data deletions Mention similar reports for different IT systems (File Servers, SharePoint/SharePoint Online, OneDrive for Business, SQL Server) Tell about audit trail, show Data Access Trend   To be more proactive and react in a timely manner in detecting any user actions that violate your data protection policies, you should consider subscribing to the following reports: Files and Folders Deleted, Data Deletions, Files and Folders Moved, Files and Folders Renamed, and Files Copied. Show Files and Folders Deleted
• #18: Paragraph 2 of the Article 5 states the controller shall be responsible for, and demonstrate compliance with, paragraph 1 (‘accountability’).   How can this be achieved? You can demonstrate the effectiveness of your data protection controls using a complete audit trail that is consolidated and reliably preserved by Netwrix Auditor in a cost-effective, two-tiered (file-based + SQL database) AuditArchive™ storage system. It’s easy to access the archived audit data anytime they are required for security assessments, investigations, and compliance processes. It’s also essential reports and dashboards allow you to gain meaningful intelligence about user actions compared to logs. Show reports from audit trail category: All Changes by Audited System All Changes by Server
• #20: The controller shall implement appropriate technical and organisational measures to ensure and to demonstrate that processing is performed in accordance with this regulation. Those measures shall be reviewed and updated where necessary.   How can this be achieved? Review the required Netwrix Auditor reports to gain relevant knowledge of the context around system configuration changes and data access that pose threats to personal data; use reports to get valuable details about existing controls to validate those controls and establish user accountability. Show reports on configuration States and Changes: File Share Changes All Exchange Server Changes by Object Type
• #21: The aforementioned situations define the problem of access control again. Do you know how deep the crypto-ransomware can drill into your servers if, say, an office manager gets infected by opening a pseudo-pdf instead of a bill from a furniture store? Will the ransomware be able to get to shared folders? Do those folders contain sensitive data or are they just folders with duplicates of the bills? Can you quickly find out where it started and turn off the user or the machine? Today’s main question is: How can we ruin the plans of the criminals and build an effective strategy to shield data from ransomware?
• #22: In short, data protection by design is an approach to projects that promotes privacy and data protection compliance from the start. It means that when you build new IT systems for storing or accessing personal data or use data for new purposes, you should ensure privacy and data protection are key considerations in the early stages of any project and throughout its lifecycle.   Accordingly, paragraph 1 of this article declares the controller shall implement appropriate technical and organisational measures during the determination of the processing means and during the processing itself.   How can this be achieved? To start with, you can use Netwrix Auditor reports to identify and evaluate the effectiveness of existing controls for protecting personal data. Next, make the necessary changes to improve it. When reviewing summaries of IT changes and access events across critical IT systems and applications with who, what, when, and where details, you can guarantee continuous processing control, not only control at the design stage. Also, reports provide details on all installations and removals of software applications and hardware devices; a report exists showing the creation of potentially harmful files. Periodic review of such reports will keep you updated on the current state of your overall IT infrastructure. Show reports on all installations and removals of software applications and hardware devices General Computer Settings Changes Programs Added and Removed Potentially Harmful Files   Use the Interactive Search feature to search through consolidated audit trails and quickly find the exact information you need. Interactive Search enables you to create easy-to-read custom reports with just a few clicks, simplifying the investigation of security incidents or data breaches and helping you quickly understand why and how those events happened. Demonstrate Interactive Search to find all the users who have been accessing a sensitive file/folder within the last week
• #23: The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data – which are necessary for each specific purpose of the processing – are processed. In particular, such measures shall ensure that, by default, personal data are not made accessible to an indefinite number of natural persons.   How can this be achieved? You must be sure only authorised users have access to personal data. Check the reports showing permission states and group membership states. Then, subscribe to daily or weekly reports showing changes to user permissions and group memberships to control privilege delegation. Show reports reflecting “who has access to what” conception: Active Directory State in Time o Effective Group Membership o User Accounts – Group Membership Group Policy Changes o Account Policy Changes o Security Settings Changes   Reports on excessive permissions, failed activity trends, and newly created files that might contain sensitive data can help you spot anomalous activity and prevent data breaches or personal data misuse. User Behavior and Blind Spot Analysis -> Information Disclosure -> Creation of Files with Sensitive Data report Active Directory -> Logon Activity -> Failed logons Show failed activity trend   We also recommend reviewing reports that show enabled, disabled, expired, and locked user accounts, and coordinate with your HR department regarding all user statuses. Active Directory -> User Accounts -> Expired Active Directory -> User Accounts -> Locked
• #24: Here we see that the controller and the processor shall implement measures to ensure a level of security appropriate to the risk, including (b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services. (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident. (d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.   How can this be achieved? Overview dashboards will provide a high-level picture of what is happening in your IT infrastructure, including how often changes are made, which systems are most affected, and whether there are unusual spikes in the number of modifications and file and folder access attempts. Audit Trail Show Enterprise Overview reports All Changes     Moreover, all of the predefined reports we’ve already shown can be helpful in getting a broad understanding of the context in which security incidents occurred, finding the root cause of a problem, and establishing user accountability.   Also, Netwrix Auditor enables you to quickly revert unauthorized or accidental Active Directory changes to a previous state and restore deleted objects when needed, without any domain controller downtime or having to restore from backup. Demonstrate Active Directory Object Restore feature
• #25: The controller and processor shall take steps to ensure that any person with access to personal data does not process them except on instruction from the controller, unless he or she is required to do so by Union or Member State law.   How can this be achieved? Subscribe to the Activity Outside Business Hours report to stay aware of any employees active on the network at times when they are not supposed to perform any actions. Active Directory -> Activity Outside Business Hours   Periodically review the Access to Archive Data report to detect any suspiciously high number of file reads in your archive storage, which might indicate malicious activity. File Servers - > Access to Archive Data   Use the video recording capability of Netwrix Auditor to capture the screen activity of privileged users in critical IT systems and applications that do not produce any logs. Demonstrate Video Recording Capability
• #26: In the case of a personal data breach, the controller shall, without undue delay and where feasible, notify supervisory authority of the personal data breach no later than 72 hours after the controller becomes aware of the breach.   To do so, use preconfigured alerts to respond quickly to threat patterns that violate corporate security policies and indicate possible cyber security incidents, including a personal data breach. The notifications, which you can easily customize, are sent to the specified emails as the events occur, enabling you to rapidly react to a possible data breach and promptly notify authorities. Show alerts function – Show real time alerts for AD and ELM   Assign a group of people to continuously monitor critical IT systems by subscribing them to receive critical audit reports daily or on any other schedule. Show that each report can be delivered to multiple recipients at the same time without the need to configure each subscription separately – Discuss functionality of Report Subscriptions   You can find detailed information about which Netwrix Auditor reports can be used to address specific GDPR requirements in our mapping, attached in the handouts section.   Thus, to prepare for the GDPR, an organisation needs to undertake joint administrative, technical, and physical initiatives. Netwrix Auditor helps organizations across the globe achieve and demonstrate compliance with the GDPR’s key data protection provisions. With Netwrix Auditor, you get the visibility you need for your controls, processes, and practices to ensure they are aligned with the regulation’s requirements.
• #28: Because changes happen every day, and you need to be 100% sure that everything is still set properly. Using Netwrix Auditor, review the Account Permissions report regularly. Excessive Access Permission — Identify users who don’t use the files for which permissions were granted to them. Object Permissions by Object — See which account permissions are associated with particular critical files and shares, and how those permissions were assigned to users: directly or through group membership. User Activity Summary — Subscribe to threshold-based reports on user activity to be notified whenever a user exhibits behavior that matches a known crypto-ransomware pattern, such as modifying a large number of files in a short time. Security Groups Membership Changes — Detect improperly delegated access If it seems that the attack already has started, use the Interactive search — Review all changes to the Windows registry startup keys, paying particular attention to the Run-key settings. If ransomware has already changed these settings, Netwrix Auditor will show you the path to its execution file, facilitating the removal and remediation process. Integrate NA with SIEM solution and get early warnings. Do you remember the key question I asked in the first part: How can we ruin the plans of the criminals and build an effective strategy to shield data from ransomware? My answer is thus: Gain visibility into your IT-infrastructure and build a smart security strategy to lower the possibility for the malicious software to sneak into your environment.
• #46: With this release we focus on User behavior analysis and risk mitigation. The highlights of the release are listed here on the slide. We have a list of great new features that address the needs of organizations that need to respond to the ransomware threats, aberrant users’ insider activity and other challenges.