3 Essential Steps in Implementing a Comprehensive User Monitoring Program

Earlier this year, the Government Accountability Office revealed that the General Services Administration suffered from significant shortcomings in its ability to monitor the cyber activity of employee users—especially those who faced pending terminations.

Specifically, the GSA’s Insider Threat Program (ITP) team was unaware of which employees were subject to termination review, and took no action to monitor them for potentially malicious IT account activity. According to the GAO, “the IT account activity of these employees was not subject to additional monitoring after they received their Notices of Proposed Removal … These deficiencies expose GSA information to theft or loss, facilities to damage, and personnel to actual or threatened harm; and create gaps that can be exploited in other ways to undermine GSA’s ability to effectively carry out its operations.”

The development represents an extreme but real-life scenario that illustrates the critical need for federal agencies to take a proactive, strategic approach to monitoring user behavior: The White House’s  “Executive Order on Improving the Nation’s Cybersecurity”  calls for the deployment of comprehensive monitoring as part of its zero-trust architecture requirement. Additionally, the Cybersecurity and Infrastructure Security Agency Continuous Diagnostics and Mitigation (CDM) Program delivers tools, integration services and dashboards that enable agencies to increase visibility and reduce their threat surface by enhancing their near real-time monitoring and risk response.

In addition, federal insider threat-related spending topped $1 billion in fiscal year 2020 , with IT products that closely monitor users emerging as “more important than ever.” These investments are on the rise because 94% of organizations have experienced at least one insider-caused data breach within the last year, with 84% suffering from a serious insider breach due to human error; 74% due to employees breaking security rules; and 66% because of malicious leaks.

The government is hardly immune to these incidents. Therefore, agencies must implement a comprehensive user monitoring program that effectively combines the human intelligence of the security operations center, or SOC, with the automated insights of machine learning/artificial intelligence—in conjunction with the security analytics capabilities inherent to those platforms. In pursuing this, federal chief information security officers should incorporate the following three essential steps into their strategies:

Initially focus on users who matter the most. In this case, those are the people who can do the most damage, whether unintentionally or by design. It takes time for a ML/AI-enabled monitoring program to scale. So it’s best to focus first on employee teams that routinely access the “crown jewel” cyber assets that—if compromised—can cause the greatest negative impact (i.e., human resources, legal and finance functions). There should be a special focus on staffers with a history of risky behavior, such as unknowingly clicking on malicious links sent by an unknown/suspicious party.

To avoid the same issues found within the GSA, CISOs should add employees facing definite or possible terminations to this list.  But while they’re still working, they can’t get shut out of systems they regularly access. That’s why monitoring proves indispensable, so SOC teams maintain 100% visibility/awareness of these employees’ activities without disrupting task and project completion.

Establish zero trust. The White House Executive Order is calling for agencies to proceed toward a zero-trust architecture and adopt the migration steps that the National Institute of Standards and Technology has outlined. Zero trust is about abiding by the tenets of “never trust, always verify”—SOC teams assume anyone on the network is potentially hostile or capable of triggering a breach.

After eliminating implicit trust, teams must seek “continuous verification of the operational picture via real-time information from multiple sources to determine access and other system responses,” according to the order. This is where continuous monitoring limits access to solely what is required to perform an approved/authorized function.

Cover the bases. The fundamentals remain. You still must rely upon firewalls, forward proxies, packet protection, replay ability, etc. to defend assets and gather all the information required to conduct incident or suspicious behavior investigations.

A comprehensive security analytics-based user monitoring program is not about tracking every keystroke. It is about being aware of whether a user entered a system and/or accessed a file that isn’t required to perform an approved task or function, and then determining whether unauthorized changes were made or if network assets were removed, modified, or compromised.

The combination of scaling user monitoring, implementing zero trust and remaining committed to the foundational cybersecurity pillars will enable agencies to greatly reduce the risk of insider threats. 

They will “see” everything they need to see but stop only that which needs to stop.

Heath Mullins is a cybersecurity solutions architect at Merlin Cyber.