Ekran System v Program Overview

Transcription

1 Ekran System v. 6.2 Program Overview

2 Contents About the Program Login Ekran Server & Management Tool Notifying Users about Being Database Management Monitored Licensing User Blocking Client Installation & Update Viewing Sessions Monitoring Parameters Alerts Offline Client Detection ( Lost USB Monitoring Clients) Dashboards Client Protection Interactive Monitoring Advanced User Authentication Reports Two-Factor Authentication Application Customization Privileged Account and Session Health Monitoring Management Administrator s Approval on Page 2 of 128

3 About the Program Page 3 of 128

4 About the Program Smart user activity video recording system. Privileged Identity Management Employee Work Control Privileged Password and Session Management Cost Saver on the Market Ekran System allows creating indexed video records of all concurrent Windows, Citrix, and Linux terminal sessions on your servers and record remote and local sessions on workstations, including macos. Are you interested in your company's security? Do you want to know what your employees do during their working hours? Do you want to control sensitive information use? PASM helps you to provide privileged access to critical assets and meet compliance requirements by securing, managing and monitoring privileged accounts and access. Ekran System provides all popular segment features while offering much more beneficial pricing than ObserveIT or Citrix Smart Auditor. Page 4 of 128

5 About the Program Ekran System is an affordable user monitoring solution for enhanced cyber security. You can record all terminal, remote, and local user sessions and alert security personnel to suspicious events. Ekran System Components Ekran Management Tool Ekran Server Ekran Clients Windows/macOS/Linux/Citrix GUI part used for system management & session viewing Main component used for storing data obtained from Client computers Components installed on the target computer to monitor user activity and send it to the Server Page 5 of 128

6 Ekran System Structure Page 6 of 128

7 High Availability Mode (Enterprise Edition) The High Availability mode provides a high level of operational performance and balances the load of sent data, minimizing downtime and service interruptions. Page 7 of 128

8 Disaster Recovery Mode The Disaster Recovery mode allows you to configure and deploy Ekran System in such a way that if the Ekran Server stops functioning for any reason, another Ekran Server instance can replace it without data loss and reinstallation of the system. Page 8 of 128

9 Single-Tenant/Multi-Tenant Mode The Multi-tenant mode allows multiple strongly isolated tenants to operate in Ekran System environment. Data of each tenant is independent and not accessible to other tenants. Page 9 of 128

10 Ekran Server & Management Tool User management, permissions, Active Directory Integration, Management Tool settings Page 10 of 128

11 Management Tool You can manage the whole system via the Management Tool in your browser. Page 11 of 128

12 Tenant Management Ekran System has Single-tenant and Multi-tenant modes. The Single-tenant mode is selected by default. In this mode, all users have access to all Clients and settings according to their permissions. In the Multi tenant mode all tenant users have access to their tenant Clients, but they have no access to other tenants Clients, configurations, alerts, reports, etc. You can switch to the Multi-tenant mode any time. Page 12 of 128

13 User Management & Permissions Create two types of users: Internal or Active Directory (Windows domain users/groups). Use groups for easier user management. Define permissions for users. Page 13 of 128

14 Active Directory Integration Integration with Active Directory allows you to establish the domain trusts with multiple domains. Page 14 of 128

15 Active Directory Integration Integration with Active Directory allows you to do the following: Add users & user groups from trusted domains to allow them to access the Management Tool and Client machines with enabled Forced User Authentication. Create alerts for domain groups to quickly respond to suspicious user activity on the Client computers belonging to trusted domains. Page 15 of 128

16 Management Tool Log Audit all user activities performed in the Management Tool via the Management Tool Log with the detailed information on all changes. Page 16 of 128

17 Database Management Page 17 of 128

18 Database Configuration Page 18 of 128

19 Database Cleanup One-Time Cleanup Scheduled Cleanup Page 19 of 128

20 Database Archiving (Enterprise Edition) Archive and delete the old monitored data from the Database to not run out of space on the Server computer and to save the monitored data in a secure storage. Page 20 of 128

21 Database Archiving (Enterprise Edition) You can view the archived sessions from your archived database in the Session Viewer and perform searches in them in a usual way at any time. Page 21 of 128

22 Isolating Database from Clients (Enterprise Edition) You can disconnect all Clients from the database and send them offline so that you can fix issues with the database, run database cleanup and maintenance without stopping the Ekran Server. Once database work is restored, you can return all Clients online in one click. Page 22 of 128

23 SIEM Integration Ekran System integrates with your SIEM system using log files of the monitored events. Page 23 of 128

24 Advanced SIEM Integration Get access to the Ekran System alert events and monitored data by creating a separate log file in one of the following formats: Common Event Format (CEF): (can be viewed and analyzed by the Splunk or ArcSight monitoring software) Log Event Extended Format (LEEF): (can be viewed and analyzed by the IBM QRadar monitoring software) Page 24 of 128

25 Licensing Types of Licenses & Serial Key Management Page 25 of 128

26 Licensing Ekran System is licensed by the number of Ekran Clients, endpoints to be monitored. All management components, including Server and Management Tool, are provided for free with any deployment. Types of Ekran Client licenses: Terminal Server Client license Infrastructure Server Client license Cloud Server Client license Workstation Client license Linux / UNIX Server Client license Page 26 of 128

27 Licensing Page 27 of 128

28 Serial Key & License Management Request a trial serial key for 30 days to deploy the system and review its basic features with a restriction of 3 Workstation Client licenses, 3 Linux/UNIX Server Client licenses, and 1 Terminal Server Client license. To work with Ekran System for a longer period, license it by activating the serial keys on the computer with the installed Ekran Server. You can use either permanent keys, or update and support keys. Page 28 of 128

29 Enterprise Key Activate Enterprise serial key to get exclusive access to a set of additional, valuable features of Enterprise Edition of Ekran System. Page 29 of 128

30 Unique Enterprise Edition Features Features available only for Enterprise Edition: High Availability Multi-tenant Privileged Account and Session management Offline Clients detection ( Lost Clients) Integration with ticketing system System Health Monitoring Server Resource Monitoring Database archiving Advanced SIEM Integration IP Filtering Page 30 of 128

31 Client Installation & Update Page 31 of 128

32 Installing Ekran Clients Convenient Ekran Client installation: Local: o Linux Clients (via tar.gz file) o macos Clients (via tar.gz file) o Windows Clients using installation file with default parameters using generated package with customized parameters Remote (for Windows Clients) Remote Installation Select computers to install Clients on Customize installation parameters The Clients are successfully installed! Page 32 of 128

33 Target Computers for Remote Installation Scan your local computer network Define a range of IP addresses to search the target computers Simply enter target computer names Page 33 of 128

34 Updating Ekran Clients When Ekran Server is updated to a newer version, all Clients are automatically updated to the same version after their first connection to the Server. If you want to personally supervise the update process of target Clients, you can disable the Update Client automatically option on them. Page 34 of 128

35 Monitoring Parameters Page 35 of 128

36 Client Monitoring The screen captures the Client sends are stored in the form of deltas (differences between a newer recorded screen capture and an older one) to minimize storage space. Recorded information is saved in an easy-to-review and easy-tosearch form: The name of the launched application The title of the active window Entered URL Text entered via user s keyboard (keystrokes) Clipboard text data (copied and pasted text) Commands executed in Linux (both from user input & by running the scripts) The information on plugged-in USB devices Page 36 of 128

37 User Activity Recording Ekran Client user activity recording is event-triggered by default. You can configure Windows and macos Clients either to screenshot active window only or to record user activity without taking screenshots. Page 37 of 128

38 URL Monitoring Ekran Client monitors URLs entered in web browsers. You can configure the Client to monitor full URLs or domains of top and second level only. Page 38 of 128

39 Keystroke Logging To ensure the GDPR compliance, all logged keystrokes are hidden, but you can perform searches within them and create alerts to be triggered when specific words are typed. Also, keystrokes can be filtered, which allows you to reduce the amount of information received from the Windows Client and grant that there is no privacy violation by defining applications where keystrokes will be monitored. Page 39 of 128

40 Keyword-Triggered Monitoring You can configure Ekran Clients to start monitoring and creating screen captures only after detecting the defined keywords entered by the user in specified applications. Page 40 of 128

41 Clipboard Monitoring Ekran Client captures all text data, which has been copied or cut and then pasted into documents, files, applications, browser address bar, etc. on the Windows Client machines. You can adjust an alert to be triggered whenever the user copies or cuts information and pastes it. Page 41 of 128

42 Application Filtering Ekran System allows you to define the filtering rules for websites/applications to adjust the amount of monitored data and exclude the areas where private information can be observed to comply with corporate policy rules and country regulations related to user privacy. Page 42 of 128

43 Monitoring Time Filtering In addition to application filtering rules, you can define monitoring time filtering ones. By selecting certain days of the week and defining specific hours, you can establish the bounds in which Ekran Clients will record all user activity. Page 43 of 128

44 IP Filtering Additionally, you can filter out sessions from certain remote IP addresses or monitor only sessions from certain IP addresses. Page 44 of 128

45 Privileged User Monitoring Monitor the activity of users logging in under privileged user accounts. Page 45 of 128

46 Client Group Settings You can define the settings for a Client Group and then apply them to the Client to save your time. Page 46 of 128

47 Offline Client Detection ( Lost Clients) Page 47 of 128

48 Offline Clients Detection ( Lost Clients) Offline Client detection will help you to timely detect Clients that have stopped transmitting monitoring data. Just define the time period after which the Clients will be considered lost and get notified about such incidents. Page 48 of 128

49 Viewing Offline Clients ( Lost Clients) You can view all Clients that are offline for more than specified time period on the Offline Clients page. Page 49 of 128

50 Client Protection Page 50 of 128

51 Protected Mode Ekran System allows you to protect Windows Clients and their data by enabling the Protected Mode. The usage of Protected Mode has the following advantages: Prevention of Client uninstallation. Prevention of stopping Client processes. Prevention of editing Client system files and logs. Prevention of editing Client settings in the registry of the Client computer. Prevention of modification, removal, and renaming of Client files. Page 51 of 128

52 Client Uninstallation Users, including privileged ones, are unable to stop the Client working on their machines, as well as remove the Client locally without the Administrator assistance. Only Ekran System Administrator knows the uninstallation key defined prior to Client installation and necessary for local removal. Page 52 of 128

53 Advanced User Authentication Page 53 of 128

54 Advanced User Authentication Advanced user authentication allows you to achieve two goals: Monitor users activity on the computer when multiple users use the same credentials to log in. Improve your security by limiting the access to the specific users who know secondary authentication credentials. Page 54 of 128

55 Advanced User Authentication (Windows Clients) The Ekran System Client requests entering credentials before allowing a user to work with Windows OS. Page 55 of 128

56 One-Time Password (Windows Clients) Enterprise Edition Ekran System provides the administrator with a unique ability to generate a one-time password for a user log in to the Client computer with Windows OS. Page 56 of 128

57 One-Time Password (Windows Clients) The user can request a one-time password directly from the secondary authentication window displayed on login to Windows OS. Page 57 of 128

58 Advanced User Authentication (Linux Clients) The Ekran System Client requests entering credentials before allowing a user to work with the terminal on Linux Client machines. Page 58 of 128

59 Two-Factor Authentication Page 59 of 128

60 Two-Factor Authentication Two-factor authentication allows you to enable an extra layer of security to better protect the critical endpoints in your network. Page 60 of 128

61 Two-Factor Authentication Add users who will be allowed to log into the Windows machines with installed Clients using time-based one-time passwords (TOTP) generated in the TOTP mobile applications. Page 61 of 128

62 Two-Factor Authentication The Ekran System Client prompts the user to enter a TOTP to start working with the system. Page 62 of 128

63 Privileged Account and Session Management Page 63 of 128

64 Privilege Account and Session Management (PASM) When deploying Ekran System on a jump server, you can use additional access management toolset, while for further RDP connections from this server you can use password vault and manage the list of accounts allowed to access the selected production servers. Page 64 of 128

65 Password Vault The account credentials are automatically generated, encrypted and stored in SQL Password Vault. To enhance data access security, privileged user is not able to access specified endpoints after the expiration date. Page 65 of 128

66 Adding Privileged Account Define a privileged user to give access to, computers to be accessed, and the privileged account settings. Page 66 of 128

67 Logging in under Privileged Account You can log in under the privileged account using the Ekran System Remote Access. Page 67 of 128

68 Administrator s Approval on Login Page 68 of 128

69 Administrator s Approval on Login Administrator s approval on login allows you to better protect the Client machines in your network from undesired access. Page 69 of 128

70 Administrator s Approval on Login Add users whose access to the Client machines needs to be restricted. Page 70 of 128

71 Administrator s Approval on Login When the restricted user logs into the Client machine, the Client blocks the desktop and sends the user s access request to the administrator. Page 71 of 128

72 Administrator s Approval on Login After the administrator confirms the user s access request, the user is allowed to start working with the system. Page 72 of 128

73 Notifying Users about Being Monitored Page 73 of 128

74 Notifying Users about Being Monitored To follow the security policy of your company or your country regulations, you can: Enable displaying an additional message on user logging in to notify the user that his or her work is being monitored. Display a Client tray icon with the notification about monitoring to the user. Page 74 of 128

75 Notifying Users about Being Monitored Require the users to enter the comments to the additional message displayed on their login to the Client computers. Page 75 of 128

76 Notifying Users about Being Monitored Require the user to enter a valid ticket number created in the integrated ticketing system to start working with the Client machine. Page 76 of 128

77 User Blocking Page 77 of 128

78 User Blocking Overview Ekran System allows you to block users performing potentially harmful and forbidden actions on computers with Windows OS with Ekran Clients installed on them. Users can be blocked manually from both Live and Finished sessions, or automatically when they perform an action that triggers a specific alert. Page 78 of 128

79 User Blocking Overview The user desktop is blocked, and after the defined time interval the user is forcibly logged out. If the blocked user tries to log in to the Client computer, the system does not allow him/her to do so. Page 79 of 128

80 Viewing Blocked User List The Blocked User List contains information on when, and why the user was blocked. To allow the users access to the Client Computer, remove them from the list. Page 80 of 128

81 Viewing Sessions Page 81 of 128

82 Searching Data in Session List Ekran System Management Tool allows searching in the recorded sessions. Search is performed by different parameters: For Windows Clients: active window title, application name, user name, Client name, visited URL, clipboard text data, user s comment to the additional message, ticket number, USB device information. For macos Clients: active window title, application name, user name, Client name, visited URL. For Linux Clients: commands, command parameters, and command output. Page 82 of 128

83 Viewing Live Session Ekran System allows you to perform monitoring of user activity in real time. You can connect to a Live session and observe the activities a user is performing at the given moment. Page 83 of 128

84 Magnifying Glass You can enlarge certain parts of the video in the Session Player by using the Magnifying Glass. Page 84 of 128

85 Forensic Export With Ekran System Forensic Export, you can: Export a monitored session or its part to a securely encrypted file. Investigate the recorded user activity in the in-built offline session viewer. Present evidence in forensic format to the third parties. Page 85 of 128

86 Alerts Page 86 of 128

87 Setting Up Alerts Ekran System allows you to enable quick incident response using alert notifications: Set up alerts about suspicious user activity on the Client computers. Specify individuals to receive instant alert notifications via or in the Tray Notifications application. Page 87 of 128

88 Alert Actions You can set the alert to: Display a warning message to the user when the alert is triggered. (The message can be edited) Block the user. Forcibly stop the application. Page 88 of 128

89 Default Alerts Ekran System contains a set of default alerts prepared by the vendor security experts. They will alarm you about data leakage, potentially fraudulent, illicit, or work-unrelated activities. Page 89 of 128

90 Alerts in Session Player Monitored data associated with alert events is highlighted in different colors in the Session Player according to the alert risk level. Page 90 of 128

91 Alerts in Alert Viewer You can view detailed information on all alert events as well as screen captures associated with them in a special viewer. Page 91 of 128

92 Receiving Alerts Receive alert notifications in real time, review them in the Ekran System Tray Notifications journal, and open the session with the alert-related data in the Session Player. Page 92 of 128

93 USB Monitoring Page 93 of 128

94 USB Monitoring Overview Ekran System provides two types of monitoring USB devices plugged into the Windows Client computer: USB-based storage monitoring, to view information on the devices detected by Windows as mass storage and receive alert notifications. Kernel-level USB monitoring, for an in-depth analysis of pluggedin devices and their blocking. Page 94 of 128

95 Setting Up Kernel-level USB Rules Ekran System can detect USB devices connected to a computer, alert you on device plugging in, and block their usage (either all devices of a certain class or all except the allowed devices) on a Client computer. Page 95 of 128

96 USB-Based Storage Monitoring USB-based storages are automatically detected on being plugged in. Page 96 of 128

97 Kernel-Level USB Monitoring Screen captures created on USB devices being plugged in or blocked are highlighted in the Session Viewer. Page 97 of 128

98 Dashboards Page 98 of 128

99 Dashboards Overview The dashboards offer a convenient real-time view of the most useful data grouped in one place. Customize the dashboards on the Management Tool Home page by adjusting their look and settings. Page 99 of 128

100 Dashboard Types There are four main types of Ekran System dashboards: System State Dashboards o Licenses o Clients o Database Storage Usage Monitoring Dashboards o Recent Alerts o Latest Live Sessions Threat Detection Dashboards o Sessions out of Work Hours o Rarely Used Computers o Rarely Used Logins Server Resource Monitoring o CPU Usage o Memory Usage o Database State Page 100 of 128

101 System State Dashboards Clients Database Storage Usage Licenses Page 101 of 128

102 Monitoring Dashboards Recent Alerts Latest Live Sessions Page 102 of 128

103 Threat Detection Dashboards Rarely Used Computers Rarely Used Logins Sessions out of Work Hours Page 103 of 128

104 Server Resource Monitoring CPU Usage Memory Usage Database State Page 104 of 128

105 Interactive Monitoring Page 105 of 128

106 Interactive Monitoring Overview You can filter out data by three parameters: Who: filter by a specific user logged into the Client computer. Where: filter by a specific Client. When: filter by the time period. Additionally, you can set the order of bars being displayed, using the Applications and URLs filters. Data is displayed in the form of two column charts (Application Monitoring chart and URL Monitoring chart). To see the list of application/website entries, click on the column with the application/website name. Page 106 of 128

107 Application Monitoring Chart This chart provides information on the application usage frequency. You can also use this chart to analyze information on the most and least used applications and detect any threats and suspicious activity on investigated computers. Page 107 of 128

108 URL Monitoring Chart This chart provides information on the website visiting frequency. You can also use this chart to analyze information on the most and least visited websites and detect potentially harmful activity on investigated computers. Page 108 of 128

109 Reports Page 109 of 128

110 Reports & Statistics Ekran System Reports provide the full overview of the time spent in applications and on websites visited on the user s machine. Generate a highly customizable report ad-hoc or schedule sending reports to your on a daily, weekly, or monthly basis. The reported activity can include alerts, launched applications, visited websites, plugged-in/blocked USB devices, and executed Linux commands. Scheduled Reports Page 110 of 128

111 Reports & Statistics The reports can be generated manually at any time for any time period. Manual Report Generation Page 111 of 128

112 Report Types Activity summary report Activity pie chart report Activity chart report Page 112 of 128

113 Report Types User statistics report Clipboard grid report Page 113 of 128

114 Report Types Session grid report Sessions out of work hours grid report Page 114 of 128

115 Report Types Detailed Activity report User daily activity grid report Page 115 of 128

116 Report Types Alert grid report Page 116 of 128

117 Report Types URL summary report URL pie chart report URL chart report Page 117 of 128

118 Report Types USB storage grid report Kernel-level USB storage grid report Page 118 of 128

119 Report Types In the Linux grid report, you can view all exec* and sudo commands executed on Linux Client computers. Linux grid report Page 119 of 128

120 Application Customization Page 120 of 128

121 Date and Time Format Date&Time Format configuration allows you to define the date and time format for the Management Tool and the Server. Page 121 of 128

122 Custom Logo on Client Notifications Custom Logo settings allow you to enable using custom graphic files instead of the default logo on the Client notifications during secondary authentication, user blocking, etc. Page 122 of 128

123 Report Customization Custom Reports settings allow you to enable using custom graphic file instead of the default logo in the reports. Also, you can add the header and footer text in the reports. Page 123 of 128

124 Custom Subjects Custom Subjects settings allow you to define the subjects to be used in notifications sent by Ekran System. Page 124 of 128

125 Health Monitoring Page 125 of 128

126 System Health Monitoring System Health Monitoring allows you to get detailed information about the database storage usage and errors occurring in Ekran System which helps to monitor the system health and react to any problems in time. Page 126 of 128

127 Server Resource Monitoring Ekran System allows you to see the resource usage by the Ekran System Server process at the moment: CPU Usage by Server process Memory Usage by Server process Database State Page 127 of 128

128 Visit us online: Page 128 of 128