Preventing lateral movement

Most data breaches happen as a result of an attacker leveraging an exploitable vulnerability or insecure credentials to gain unwanted access to a network. Once they gain access, they target users and accounts to elevate privileges in order to move laterally and achieve their ultimate end. In fact, according to the 2017 Verizon Data Breach Investigations Report, 81 percent of breaches leveraging hacking techniques (misconfigurations, vulnerabilities, or exploits) leveraged stolen or weak passwords as a tactic, up from 63 percent in 2016. Further, breaches are taking organizations months and sometimes years to detect. These two trends point to an even greater need for organizations to eliminate excessive user permissions on endpoints.

PowerBroker for Windows version 7.4 helps organizations monitor and prevent lateral movement and is:

·         Flexible –New rules help IT administrators identify suspicious access and activity, and monitor and audit sessions for unauthorized access or changes to files and directories.

·         Actionable - IT administrators can either flag the activity or prevent the user from issuing potentially malicious commands. This reduces the attack surface by removing administrator rights from end users and employing fine-grained policy controls for all privileged access, without disrupting productivity.

·         Measurable – PowerBroker for Windows includes reports on lateral and suspicious activity by user to measure the end results and effectiveness of the technology.

“While security information and event management (SIEM) solutions are used by organizations to track all events and activity throughout the network, these solutions are typically not user-based down to the desktop nor proactive,” said Morey Haber, Chief Technology Officer at BeyondTrust. “With PowerBroker for Windows version 7.4, rules can be proactively set to monitor users anywhere  whether at home, office, or traveling, and also prevent users with lower level privileges from attempting to compromise credentials or perform inappropriate lateral movement – both signs of a potential attack.”