What User Behavior Analytics Can Tell You About Data Threats

Behavioral analytics has long been a staple of marketing strategies. But as data use — and sensitive data use in particular — becomes more ubiquitous, its role in data security strategies is becoming more prominent.

Data users’ behavior can reveal a lot about their intentions. But it can be challenging to track user behavior across modern hybrid and multi-cloud environments. And teams often struggle to determine which activities are problematic — individual behaviors that are acceptable when performed alone can indicate malicious intent when performed in tandem with others. User behavior analytics (UBA) solutions leverage statistical analysis techniques and machine learning (ML) algorithms to examine user behavior in a holistic manner and quickly identify anomalous activity that may indicate a threat.

What is User Behavior Analytics (UBA)?

The technology behind user behavior analytics solutions enables organizations to scrutinize massive amounts of user data across environments and flag activity that could indicate a security breach or data exfiltration. UBA works by analyzing data users’ behavior patterns, including their activities, access requests, and interactions with applications, to detect irregularities that correlate with possible malicious activity.

UBA tools begin by establishing a baseline, looking at data from relevant sources to understand how users typically behave. Using this starting point, the solution begins detecting atypical behavior and flagging it for further investigation. The longer a UBA tool is in operation, the more accurate it becomes.

How Does UBA Differ From UEBA?

User entity and behavior analytics (UEBA) is similar to UBA, but it’s a newer and more comprehensive approach that incorporates more advanced technologies, such as artificial intelligence (AI). Here are four key differences between UBA and UEBA:

• Scope of Analysis: UBA focuses on individual user behavior, whereas UEBA goes further to include the behavior of non-human entities such as servers, routers, connected devices, applications, and other systems that interact with the network.
• Amount of Context: While some UBA solutions take into account certain contextual elements such as time of day and location, UEBA solutions typically offer more robust contextual analysis, including factors such as working hours and typing patterns.
• Number of Data Sources: UBA usually relies on data located in the organization’s SIEM system. UEBA looks at data from additional sources such as endpoint detection and response systems, and threat intelligence feeds.
• Level of Automation: UEBA solutions typically have greater automation capabilities than UBA solutions, requiring less hands-on involvement from data security team members and resulting in faster response times.

Data Sources to Fuel UBA and UEBA

UBA and UEBA systems require a variety of data to provide a comprehensive view of user activity. This data makes it possible for the tools to perform at their peak, detecting patterns of behavior that may represent a security threat, even if they are not immediately evident from any one source. Here are seven data sources that should be included in a user behavior analytics program:

• Log Files: Log files record all event activity within a system. Each log file includes a timestamp, user details, and event data. Specific types of log files may also include additional information relevant to the event.
• Network Traffic: Network traffic data provides information on both security and operational issues. For example, network traffic data can be used to detect malware.
• Security Tools and Solutions Data: Leveraging data from other data security solutions provides the UBA or UEBA with greater visibility. For example, data is often gathered from identity and access management (IAM), and endpoint detection and response (EDR) solutions.
• ERP and HR Systems: User behavior analytics systems become more accurate as they take into account additional contextual data. This data may include information on the user’s role, department, and job function, sourced from enterprise resource planning (ERP), human resources (HR), or other business systems.
• Threat Intelligence Data: Modern UEBA tools source data from publicly available or commercial threat intelligence feeds and frameworks, incorporating up-to-date information on known or emerging threats, such as malware, malicious domain names, and other security risks.

What User Behavior Analytics Reveals

User behavior analytics has a key role to play in strengthening an organization’s overall security posture, as it can reveal a variety of security threats and vulnerabilities. Here are five common ways user behavior analytics is used to strengthen a company’s data security posture:

Detecting malicious insiders

Disgruntled current or former employees who have not yet had their access terminated can cause significant damage by deleting, corrupting, or stealing sensitive data. Since these individuals have authorized access, spotting them is incredibly difficult. Because UBA solutions are able to detect nuanced changes in user behavior that may indicate ill intent, these tools can effectively identify problematic behavior before it can become a larger issue.

Uncovering compromised user credentials

Compromised credentials often go unnoticed because it can be difficult to determine if the individual using the credentials is authorized. For example, an employee may open a phishing email or a cybercriminal may guess a password to an IoT device, neither of which would necessarily raise an immediate red flag. User behavior analytics solutions can spot subtle signs of compromise more quickly.

Accelerating post-incident security investigations

User behavior analytics provides security teams with a way to track which data was accessed, by whom, when, and how it was used, modified, or deleted. This information can be valuable for understanding the nature of an attack and the extent to which sensitive data was compromised. It can also help inform long-term remediation efforts by pinpointing suspicious activity patterns or system weaknesses.

Preventing data exfiltration

When proprietary data is stolen, businesses can suffer enormous damage, including loss of competitive advantage, reputation, and revenue due to lost customer trust and regulatory penalties. Whether a data exfiltration event involves malicious insiders seeking to profit from selling data, or an external threat such as organized crime, user behavior analytics can recognize unusual patterns in data access or downloads in real-time, and alert security personnel that a potential data theft incident is in progress.

Flagging impending systems failures

When hardware, servers, or applications are about to malfunction, they can exhibit unusual performance indicators. Although these are typically unrelated to security, user behavior analytics can serve as an early warning system, helping IT staff recognize issues early and address them.

User Behavior Analytics and Zero Trust Security

Zero Trust is a security model founded on the premise that no user, device, or application should be implicitly trusted, and standing privilege doesn’t exist. Each user must be authenticated, authorized, and validated before being granted access to privileged resources. And once access is granted, it’s only enabled for a period of time — users must repeat the process in order to maintain access. Because Zero Trust involves no standing privileges, it’s extremely difficult for bad actors to gain access via compromised credentials.

In order to implement the Zero Trust approach, organizations must know whether or not to grant access each time a request is received. In conjunction with data access control, user behavior analytics helps organizations maintain comprehensive visibility into all users, devices, assets, and entities on the network. UBA and UEBA systems track user behavior and access patterns, both on-premises and in the cloud, providing vital information that access management systems use to grant or refuse access.

Leveraging User Behavior Analytics to Meet Today’s Cybersecurity Challenges

Successfully navigating today’s rapidly evolving threat landscape requires robust data security posture management, and user behavior analytics plays an important role in securing sensitive data. By proactively identifying anomalous user behavior, organizations can more effectively mitigate immediate threats and implement the improvements necessary for creating sustainable, long-term organizational security.

Read Enabling Zero Trust for Data Analytics to learn more about Zero Trust and what you need in order to implement it.