Audit trails critical for tracking network activity
Connecting state and local government leaders
The information derived from a combination of audit trails and detailed forensics can help IT professionals trace and react to threats and even prevent future attacks.
As networks become more distributed and complex, it’s becoming ever more challenging for IT professionals to track all the events happening on their networks. Still, it’s vitally important to do so -- logging activity on an agency’s network is critical to determining who’s on the network, what applications they’re using and whether those applications can compromise the network and user data.
Let’s consider how government IT professionals can use audit trails to get to the bottom of who -- and what -- may be causing issues on their networks.
Why audit trails are important
As organizations migrate their networks and applications to hybrid cloud and multicloud environments, IT professionals should use audit trails to help gather detailed records of the events and activities.
Audit trails aren’t just for accountants; they can be indispensable in helping agencies get to the root of unusual network activity, running the gamut from user negligence and snooping to compromised credentials or malicious activity. Indeed, the National Institute of Standards and Technology’s bulletin on audit trails said they can help managers maintain individual accountability by advising users that they are personally responsible for their actions.
Audit trails can also help agencies trace problems back to their source, allowing them to respond to and remediate issues more quickly. At the same time, they keep a record showing compliance with federal privacy and security regulations, such as the Federal Information Security Management Act and the Health Insurance Portability and Accountability Act.
Most importantly, auditing can help minimize the impact of insider threats -- one of the greatest cyber risks -- and it can help identify and monitor high-risk internal accounts. According to the most recent SolarWinds public sector cybersecurity report, 52% of the federal government IT leaders who were surveyed considered careless or untrained insiders the most significant threat to their organizations.
How audit trails help identify and remediate network vulnerabilities
By using audit trails, agencies can establish a baseline for user activity and behavior. They can then use audit logs and real traffic from a NetFlow perspective to determine if there are anomalies in user activity, login data or behavior.
For example, a federal agency may have a user who is based out of a Washington, D.C., office 99% of the time, uses Office 365 products and doesn’t have access to critical network infrastructure. An audit trail can capture where this user is logged in, what applications are being used and whether the password has been authenticated.
Audit trails can also trace suspicious activity. For instance, a trail can show if a user’s credentials have been used to log in from a foreign country or to access infrastructure or software applications they’re not authorized to use. IT administrators can use these red flags to investigate further and, if necessary, shut down part of their network to minimize damage as quickly as possible.
Forensic information can help organizations pinpoint perpetrators
Organizations can use the forensic information gleaned from an audit to develop a map or timeline of how the threat arose, what path and actions the bad actor took and where the weak points in the organization’s infrastructure are. Forensic details can include information on the origins of the threat and who perpetrated it, whether it was intentional or accidental (or internal or external), the type of infrastructure or applications infiltrated and much more. Additionally, forensic details can show if an employee is using an unauthorized application capable of putting the network at risk.
The information derived from a combination of audit trails and detailed forensics can help IT professionals trace and react to threats and even prevent future attacks. This data can help administrators understand where network weaknesses lie and where patches and updates should be applied, arming them with information to help them better prepare for the next attack.