Charles Leaver – Offline Devices Must Not Escape Constant Endpoint Visibility

Written By Roark Pollock And Presented By Charles Leaver Ziften CEO

 

A study recently completed by Gallup found that 43% of US citizens that were in employment worked remotely for a few of their employment time in 2016. Gallup, who has actually been surveying telecommuting trends in the United States for practically a decade, continues to see more workers working outside of standard workplaces and an increasing number of them doing so for more days out of the week. And, obviously the number of connected devices that the typical employee uses has jumped as well, which assists drive the convenience and desire of working away from the workplace.

This mobility undoubtedly makes for happier employees, and one hopes more efficient workers, however the issues that these trends present for both systems and security operations groups must not be overlooked. IT asset discovery, IT systems management, and hazard detection and response functions all gain from real time and historical visibility into user, device, application, and network connection activity. And to be truly effective, endpoint visibility and monitoring must work regardless of where the user and device are operating, be it on the network (regional), off the network but connected (remote), or detached (offline). Current remote working patterns are significantly leaving security and functional groups blind to prospective concerns and hazards.

The mainstreaming of these patterns makes it much more tough for IT and security groups to restrict what was previously considered greater threat user behavior, for example working from a coffee bar. However that ship has actually sailed and today security and systems management teams need to be able to thoroughly monitor device, network activity, user and application, detect abnormalities and inappropriate actions, and enforce appropriate action or fixes no matter whether an endpoint is locally linked, from another location linked, or detached.

Additionally, the fact that many employees now routinely access cloud-based assets and applications, and have back-up network or USB attached storage (NAS) drives at their homes further magnifies the requirement for endpoint visibility. Endpoint controls frequently offer the only record of activity being remotely performed that no longer always ends in the corporate network. Offline activity presents the most severe example of the need for constant endpoint monitoring. Plainly network controls or network monitoring are of little use when a device is operating offline. The setup of an appropriate endpoint agent is important to make sure the capture of all important system and security data.

As an example of the kinds of offline activities that could be identified, a client was just recently able to track, flag, and report uncommon behavior on a business laptop. A high level executive moved large amounts of endpoint data to an unapproved USB drive while the device was offline. Since the endpoint agent was able to collect this behavioral data throughout this offline duration, the client had the ability to see this unusual action and follow-up appropriately. Through the continuous monitoring of the device, applications, and user behaviors even when the endpoint was disconnected, offered the customer visibility they never had in the past.

Does your organization maintain continuous monitoring and visibility when employee endpoints are on an island? If so, how do you do so?

Leave a Reply

Your email address will not be published. Required fields are marked *