In this lesson,
we will cover user behavior analytics.
User behavior analytics, or UBA,
is an advanced cybersecurity strategy
that leverages the power of big data and machine learning
to analyze user behaviors and detect anomalies
that may indicate potential security threats.
As cybersecurity threats evolve, organizations are moving
beyond traditional signature based detection methods,
and instead are turning to user behavior analytics
to create a more proactive defense posture.
Now, depending on who you're talking to,
you may hear many people call this type of technology
user behavior analytics,
again, also known as UBA,
or user and entity behavior analytics, known as UEBA.
Really, these technologies are very similar,
but UEBA as the monitoring of entities
to our user behavior analytics.
When we are talking about entities,
we're referring to things beyond your user accounts
like your routers, servers, and endpoints in the network.
Now, user behavior analytics is a rapidly evolving field
that leverages big data to understand user behavior
within system and networks.
User behavior analytics collects data from various sources
to identify patterns that represent typical user behavior.
With user behavior analytics,
our goal is to detect anomalous behavior
or instances that deviate from these established patterns
that could indicate potential security threats
such as insider threats, compromised credentials,
or external attacks.
Our user behavior analytic systems
utilize machine learning algorithms
to learn and understand normal user behavior over time.
As they learn what normal looks like,
they will then begin to understand
how to identify deviations that should be flagged
for further investigation by a member of your security team.
User behavior analytics systems
are designed to collect and analyze data
from various sources,
including network traffic, user devices,
and application logs.
This data is then processed
using advanced analytic techniques
such as machine learning and statistical analysis
to create a baseline of normal user behavior.
Once this baseline is established,
the user behavior analytic system will continuously monitor
your organization's user activity
while comparing it to the baseline
to identify any anomalies.
For example, if a user typically logs in
during regular business hours
but suddenly starts logging in late at night,
this could be flagged as anomalous behavior.
Now, this may or may not be malicious,
but because a user is working late to finish a big project,
which might be fine, but either way,
this behavior is outside their normal behavior,
so it will create an alert
for the security team to review.
If it is found to be malicious,
then the account could be suspended
and response actions undertaken.
Similarly, if a user who usually accesses
a specific set of files
starts accessing a different set of files,
this could also be flagged as suspicious.
For example, if one of our instructors
starts trying to access our human resource
or financial data, that will be flagged,
since they are normally not required
to access the more sensitive areas
of our organization's share drive.
Now, as you can probably guess,
there are a lot of benefits
of using user behavior analytics tools,
including early detection of threats,
insider threat detection, and improved incident response.
First, we have early detection of threats.
User behavior analytics tools
can be used to help organizations identify potential threats
before they cause significant damage.
By detecting anomalous behavior early,
your organization can respond more quickly and effectively
to prevent the spread of that given threat.
For example, if one of our employees
were to download a large amount of data from our servers,
this could indicate a potential server exfiltration attempt.
If we have a user behavior analytic system in place,
it could flag this behavior as anomalous
and alert our security team to a potential threat.
If we instead relied on traditional detection methods
like manual log analysis, this threat may go undetected
for several days, weeks, or even months
before a security team member identifies it.
Second, we have insider threat detection.
User behavior analytics tools
are particularly effective at identifying insider threats,
which are often some of the most difficult things to detect
using traditional security measures.
By analyzing user behavior,
our UBA tools can identify suspicious activities
that may indicate an insider threat.
A good example of an insider threat may be an employee
who started to access
your organization's sensitive information,
even though, again, they typically do not need
that kind of information to do their job.
With a UBA system,
this activity could be quickly identified
as unusual behavior and our security team will be alerted.
Third, we have improved incident responses.
By providing detailed information about user behavior,
our user behavior analytics tools can help our security team
to respond more effectively to incidents.
For example, if the system is able to detect
that a user's credentials have been compromised,
the security team can quickly take steps
to secure the account,
or the UBA tool may even be able
to log out the user account automatically
and then alert the security team
to investigate the potential compromise.
Another example might be if a user account
suddenly starts performing actions
that it doesn't typically perform.
This could indicate that the account has been compromised.
In this case, the user's account
might typically only read data
but now is suddenly trying to modify or delete data,
in which case your user behavior analytics system
would flag this anomalous behavior
that should be investigated by your security team.
So remember, user behavior analytics is a powerful tool
for detecting potential security threats
by identifying anomalous behavior
that may indicate a threat.
You may hear this technology called UBA or UEBA.
User behavior analytics, or UBA,
is an advanced cybersecurity strategy
that leverages the power of big data and machine learning
to analyze user behaviors and detect anomalies
that may indicate potential security threats.
When we call it UEBA, we are referring to
user and entity behavior analytics,
and we add in the monitoring of entities
to our user behavior analytics.
So, we are not just including our user accounts
but also devices or entities like your routers, servers,
and endpoints in the network as well.