Insider Threat Management Software

Control access. Monitor insider activity. Respond to incidents. All-in-one

ONLINE DEMO

Insider threats in cyber security, sometimes referred to as user-based threats, are one of the major risks for organizations.

Ekran System® software platform supports your insider threat program at each step: managing access, auditing activity, and detecting and responding to incidents.

The challenges of insider threats

Insiders are employees, third-party contractors, and other business partners that have legitimate access to corporate data and infrastructure.

Insider threats can entail abuse of privileged access in order to steal, corrupt, or destroy valuable corporate or employee data. But security incidents can also be caused inadvertently by those with access to corporate assets. While data breaches are the most common security issue, critical configuration changes and misuse of corporate assets also should be covered by an insider security policy.

When developing policies to mitigate and prevent insider security risks, security officers must consider specific approaches and tools. Detecting and investigating incidents caused by insiders is quite challenging for various reasons:

Insiders have authorized access.
One insider performs up to 10,000 operations per day, every day.
Insiders know the ins and outs of the system.
Insiders may collude and hide their tracks.

Recent industry research demonstrates the increasing importance of insider threat management, with security experts defining these attacks as the most silent and devastating.

Prevent insider threats with Ekran System^®

Ekran System is universal enterprise insider threat management software that meets the full spectrum of security needs on all kinds of infrastructure nodes, from desktops to jump servers.

The platform combines comprehensive activity monitoring and alerting functionality with an advanced access management and identity control toolset, manual and automated incident response, and powerful reporting capabilities. This makes Ekran System a one-stop solution to implement your insider security policy.

Monitor and investigate activity

Ekran System is a comprehensive monitoring solution to log insider user activity, flag suspicious user behavior, and provide investigators with the information required to respond to security incidents.

As professional insider threat monitoring software, Ekran System equally monitors generic and privileged user accounts, providing advanced protection techniques to guarantee that even privileged IT personnel can’t cover their tracks.

Session video recording

Ekran System allows you to record all user sessions on target endpoints. IP-based and username-based record filtering options are available.

The primary recording format is screen video recordings indexed with multiple layers of text metadata, from application names to typed keystrokes and details of connected devices.

Depending on the type of endpoint, Ekran System clients may record one, several, or all concurrent user sessions.

Key episode search

Besides providing comprehensive connection details – which are important when auditing remote sessions – Ekran System enables further session analysis. Investigators can search by various parameters (name of the active application, visited URL, command entered, or even text typed) within the current session and across all recorded sessions. Search even extends to the content of uploaded scripts.

Client protection

To ensure continuous monitoring of any user with any permissions, Ekran System includes a smart combination of watchdog and driver-level process protection mechanisms to prevent monitoring disruptions. Session recording continues locally even when the server connection is lost.

Learn more: User Activity Monitoring

Detect threats and respond in real time

Our insider threat management platform provides a highly configurable alerting subsystem that includes both customizable rules based on generic behavioral indicators of potential insider threats and an AI-powered user behavior analytics module for detecting anomalies in the routines of internal users.

Predefined and custom alerts

Ekran System provides rule-based incident flagging functionality. Its collection of alert templates covers the most common insider threat indicators. At the same time, you can enhance the system with your own alert rules using a variety of activity parameters: process names, opened web addresses, connected USB devices, typed keystrokes, or executed Linux commands.

User and entity behavior analytics (UEBA)

Ekran’s alert system includes an artificial intelligence module that baselines user behavior against multiple factors to further detect abnormal user activity and possible account compromise.

Automated incident response

To act on triggered alerts beyond merely notifying the security team, Ekran System provides options to set up automated incident response actions. These vary from warning messages obligating users to acknowledge their actions to application termination and user blocking.

USB management

Controlling USB devices is a mandatory part of any insider threat management solution. The Ekran System platform detects, tracks, and may trigger alerts upon connection of various types of USB devices. It also delivers a toolset to allow or block specific devices and device types according to whitelists and blacklists and to apply manual approval for certain USB device usage scenarios.

Learn more: Alerts and Notifications

Control access to user accounts

Ekran System enables granular access management for both privileged and general user accounts. It includes complete privileged account and session management functionality, password management, and access request workflow support. Ekran can also integrate with your ticketing system to reinforce the purpose-based access principle.

To control user identity, it includes reliable and efficient two-factor authentication options.

Learn more: Access Management

See insider threat prevention in action

In this video, we examine a popular insider attack pattern, called a leapfrog attack, on corporate servers. Learn how you can use our insider threat software to detect and stop it.

Why companies choose Ekran System^®

Full desktop and server OS support

As an agent-based software platform, Ekran System offers clients for all popular operating systems and supports virtual environments as well as any network architecture. With Ekran System, you can combine agent-based and jump server deployment schemes.

All insider threat protection functionality in a single platform

Ekran System delivers user activity monitoring and incident detection together with identity and access management functionality via a single software agent installed on target endpoints. Forget about installing and configuring multiple modules, addons, and extensions. Ekran can entirely support your insider threat-related risk mitigation plan since it’s built in accordance with NIST 800-53 and most IT security standards.

Enterprise-ready

Aimed at employee monitoring and corporate subcontractor control, Ekran System is built and tested to support tens of thousands of endpoints while maintaining exceptional stability and performance. With high availability and support for multi-tenant deployments, system resource and health monitoring dashboards, and maintenance routine automation, Ekran System scales easily and functions perfectly on big heterogeneous infrastructures.

Low total cost of ownership

The unique and transparent licensing offered by Ekran System allows for clear cost estimates and rapid time to value for deployments of any size, from small pilots to enterprise projects. Floating endpoint licensing enables license reassignment between endpoints in a couple of clicks. For virtual environments, the license provisioning process is automated to enhance your organization’s agility.

Get more with enterprise-grade insider threat detection software

Visually structured evidence trail resulting in low incident response time

Context-rich recordings significantly reduce CERT and SOC response times. One-click search across suspicious activity makes investigations faster and more effective.

AI-based compromised account detection

Cybercriminals are constantly improving their ways of compromising privileged accounts. Powered by artificial intelligence, the Ekran UEBA system can detect a hacker who has penetrated a corporate system using stolen credentials.

Lightweight software agent and highly optimized formats for storing data

The lightweight agent works silently and isn’t noticeable to users or other programs. Collected data is saved in searchable and highly optimized video, audio, and text file formats for compact log storage and easy reporting.

Active in your environment in 20 minutes or less

Ekran System is quick to install and easily integrates with SIEM and ticketing systems. You’ll get a ready-to-use solution right after a coffee break.

Ekran System^® integrations

Ekran System employee tracking software integrates with your infrastructure, including with leading SIEM and ticketing systems.

What Our Clients All Over The World Say

Dennis Fox II
CEO | President at ES Consulting

What we like the most about the Ekran is how easy it was to get started. The communication with the team is both smooth and efficient. Also, the support received from Ekran System team, both informational and technical, has always been very prompt and helpful.
Denis Gundarev
Senior Program Manager at Microsoft

Ekran System provides a great solution for customers that need a session recording and activity audits, as well as incident response functionality to detect and prevent insider threats.
Adrian Cragg
CTO of CNC Ltd

As a Managed Service Provider we are responsible for our customers' servers but aren't the only ones with access and often well intentioned 3rd parties cause disruption with unauthorised changes. Ekran gives us peace of mind that all actions carried out on the server are recorded and we can quickly identify & rectify issues. It's like having CCTV for your server and in these times of a need for heightened security and auditing this is perfect for the job.

Our cloud based centralised management console makes it easy for us to monitor all our customers in one place, which is great for a MSP as we can quickly deploy this to customers with minimal, if any, changes to their network or infrastructure.
Oron Beer
Director of Infrastructure and Computerization of Be'eri Press

Ekran gives me confidence when working with external service providers, resolves concerns about using such services we had in the past. The system monitors suppliers and if there is any concern, I can track everything.
Necati MANCAR
IT infrastructure manager, MSC Turkey Agency

Ekran System has become a great choice to record and audit user actions in our infrastructure. It delivers a powerful and flexible toolset; moreover, the Ekran team was ready to customize the platform for our needs adding several new features.
Ian Karpinski
Owner at Bushido Martial Arts

Ekran System provides a great solution that protects sensitive data and improves productivity where required. The software records sessions which gives us full context and visibility of IT infrastructure and provides us with added protection. The user activity reports also are very helpful and enhance security and productivity.

They Chose Ekran System^®

FAQ

What is user activity monitoring?

User activity monitoring software allows you to track user activity within your corporate network, across devices, and throughout your entire IT infrastructure. With user activity tracking tools, you can identify which applications, sites, and data users access and how they interact with them.

With a user activity monitoring solution, you can strengthen your current cybersecurity, protect confidential data from malicious users, and enhance insider risk management.

Why do I need to monitor user activity in my organization?

The goal of implementing a user activity tracking application is to prevent insider threats. Using activity tracking software, you can identify suspicious activity and reduce the risk of a cybersecurity incident. You can also use such software to track employees’ active and idle time to monitor employee performance.

Main reasons to monitor user activities:

1. Secure sensitive information
2. Reduce the risk of insider threats
3. Ensure that users stick to cybersecurity policies
4. Increase employee productivity
5. Comply with applicable cybersecurity standards, laws, and regulations

Is user activity monitoring legal?

Yes. Digital user monitoring is legal, but it’s regulated by legislation.

To know how to monitor user activity legally, you should check with applicable laws within your jurisdiction. Typically, legislation requires businesses to inform users of monitoring and receive their consent.

If your organization operates in the US, you should pay attention to both federal and state laws, as state laws can have their own requirements. For example, businesses that operate in Connecticut and Delaware don’t have to notify employees about email or internet monitoring. Meanwhile, employers in Colorado and Tennessee must create written email monitoring policies.

How does Ekran System monitor user activity?

Ekran System is a powerful insider threat management platform that ensures comprehensive user activity monitoring.

In particular, Ekran System monitors user activities in real time and makes video and audio recordings of user sessions so you can watch them later if needed. All records are searchable. Thus, you can find out whether a user has accessed certain data, launched specific applications, or visited particular websites during working hours.

Also, Ekran System continues monitoring user activity even if the internet connection goes down.

Does Ekran System interrupt employees’ work?

No. Ekran System does not influence the user experience. It monitors user activity smoothly without disturbing users.

However, Ekran may interrupt a user’s work if the user acts suspiciously. According to customizable rules, users can receive notifications explaining that a particular action violates cybersecurity policies. Also, your security admins can automatically or manually block suspicious sessions, users, and actions as needed.

How does Ekran System store collected data?

When monitoring user activity on an organization’s network, Ekran System gathers the necessary data and stores it securely using military-grade encryption. Ekran System doesn’t store passwords entered by monitored users.

What do I get from deploying Ekran System?

Ekran System offers more than just monitoring. Using this platform, you can:

1. Know who accesses your sensitive data and how they handle it by arranging robust real-time user monitoring
2. Prevent data leaks and breaches caused by insiders by detecting suspicious activity and instantly responding to it
3. Enhance your cybersecurity by automatically sending notifications when users violate cybersecurity policies
4. Evaluate employee efficiency by analyzing productivity reports
5. Ensure compliance with various standards, laws, and regulations including GDPR, NIST, FISMA, HIPAA, and SWIFT

As a robust insider threat management platform, Ekran System can easily be adjusted to the specific needs of your organization.

For example, you can receive automatic custom reports on a convenient schedule. Also, in case an incident occurs, you can quickly export a full monitored session or a fragment of a session into an independent file.

How can I deploy Ekran System?

Ekran System is on-premise software that supports various deployment options. You can install Ekran System Client on each endpoint or install just one Ekran System Terminal Server Client on a jump server to ensure user activity monitoring of all sessions that come through your server.

Installation is easy and takes less than an hour. If you have any questions or doubts during the process, our 24/7 customer support team will be there for you.

More FAQ

Monitor User Activity with Ekran System^®

ONLINE DEMO 30-DAY TRIAL