Using User Behavior Analytics to Detect Authentication Anomalies

In modern cyber battlefield, we face new threats daily where signatures are not necessarily known. Identifying these anomalies in regular behavior is the core of User Behavior Analysis (UBA). Common UBA applications include detection of malicious insider threats, privilege misuse, and compromised accounts. Analytics tools help make sense of varied information provided by security systems to identify potential risks. At Adobe, we generate vast amounts of security data in form of application, system and other logs. In addition, we have environment context data like employee role details and configuration management database (CMDB) data. This security data is an immense source of security intelligence. If collected diligently, the answers are already present, but the trick is to ask the right questions. This information can be compared against a security standard to find security gaps that need to be remediated, which is reactive security. However, if we use machine learning techniques and other analytics tools to ask the right questions, we can proactively identify anomalous activities. All of this is part of our broader strategy around Project ZEN – our zero-trust enterprise network initiative first introduced to the ISACA audience at CSX 2018. This talk will dive into more specifics about how ZEN works – specifically around UBA. We leverage UBA to help meet the most recent NIST guidelines around user passwords and remove the need for password changes at regular intervals. We will provide summit attendees with a blueprint they can use for a significant part of their own zero-trust network efforts. We hope that you can learn best practices from our approach that you can leverage in implementing more effective UBA at your organization.