Insider threat detection for security and compliance

Issue 4 2021 Information Security

In today’s modern and distributed enterprise, it’s more difficult than ever to proactively combat internal and external threats due to a lack of server visibility in the context of user behaviour, application updates and system configuration changes.

This lack of visibility into data access, usage, modification, movement, upgrades and IP connections creates gaps in ‘intent’ awareness and fails to identify abnormalities that signal increasing risk, such as application deployments, administrative changes and new users.

Business leaders need to rethink server visibility, detection and protection, especially considering the recent attacks on both businesses and the technology platforms they run. In virtually every successful attack there were obvious abnormal superuser account activities, anomalous file downloads and changes in packaged software processes. These attacks all offered ‘indicators of intent’ that should have triggered elevated risk scores and immediate investigative action.

Most leaders are still not aware that there are next-generation infrastructure awareness capabilities to protect cloud, on-premises and virtual servers from data breaches, insider threats and outsider infiltration.

The latest DTEX InTERCEPT offerings provide these enhanced capabilities to monitor and secure server infrastructures. Its patent-pending DMAP+ technology drives intelligent metadata collection and activity correlation across cloud, on-premises and virtual environments. This helps identify privileged account misuse, unauthorised use of administrative tools, unusual application updates and behaviour, systems configuration changes, domain fronting and more.

This solution brings a level of visibility to the fore that synthesises access, activities and modifications to proactively identify and eliminate threats before data is exfiltrated. It protects servers deployed on-premises, on cloud and on virtual infrastructure from security threats. This is done by providing real-time visibility into all server activity and applying advanced analytics to discern legitimate activity from malicious activity.

DTEX’s advanced analytics engine continuously monitors servers to surface abnormalities, or Indicators of Intent, to help organisations autonomously identify threats to their environments, including those associated with data loss like reconnaissance, obfuscation and circumvention. It provides customers with the mission-critical ability to pinpoint threats early in the kill chain and identify risky behaviour before exfiltration attempts occur.

Key capabilities and features that DTEX InTERCEPT delivers to help organisations more completely monitor and protect their servers include:

Full visibility. Traditional solutions focus either at the perimeters or only on the endpoints, creating security visibility gaps where organisations store their information – on servers. By combining behavioural data loss prevention with advanced server monitoring and protection, customers can more adequately protect their assets.

Critical file monitoring. DTEX allows customers to closely monitor specific files of interest, such as sensitive customer information, financials, intellectual property and more. Through continuous monitoring, DTEX automatically identifies abnormal activity to alert customers of any risky behaviours or threats associated with their most sensitive information.

Privileged access monitoring. DTEX InTERCEPT monitors the access of server resources by users, in order to ensure this privilege is not being abused. Its intelligent automation can easily spot anomalous access behaviour and flag activity that deviates from the norm, arming customers with the assurance that employees are operating as expected.

Predictive data loss prevention. DTEX InTERCEPT understands intent and context related to data loss by profiling and base-lining user, application and system behaviours. Streaming and scored audit trails provide customers with real-time awareness of abnormalities that indicate emerging risk to servers, leading up to attacks. This helps SecOps and IT teams eliminate risks before data is exfiltrated.

Performance interoperability. When applied to servers, DTEX InTERCEPT causes little to no impact on overall performance. The platform is deployed across even the largest environments with ease and has no noticeable impact on server workloads or performance.

The increased visibility of activity combined with the built-in power of analytics and correlation helps improve your compliance by ensuring that you know exactly where you need to focus your attention.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...
Cybersecurity in South Africa
Information Security
According to the Allianz Risk Barometer 2025, cyber incidents, including ransomware attacks, data breaches and IT outages, are now the top global business risk, marking their fourth year at the top.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.