Have you heard about user behavior analytics tools (UBA tools) yet? It seems to be a genuine buzzword right now, with auditors and security managers being all over it. However, security administrators don’t seem to have caught on to this yet. This is a shame since, thanks to UBA tools, IT teams can quickly track and analyze any changes or oddities in the way users within an organization behave. They can also create watch lists and monitor them, spot trends, and use a host of other data that links straight back to what employees do. A UBA, in other words, is a very important tool in terms of statistics and analytics, which is what it was designed for, but it is equally important for security. However, IT professionals should not confuse it with a security tool. While this is an added benefit, UBA tools cannot every replace firewalls, virus scanners, and other such tools.
Why It Is Great for Monitoring but Less Good for Security
There has been some confusion lately due to the fact that a major global security conference discussed the importance of having UBA tools in place. While it is certainly true that these tools can enhance security, they cannot create it. Security analysts, therefore, should not use it as a starting point. This is for two key reasons:
- It is hugely unethical to use UBA to monitor security, as you invade people’s privacy.
- It is very inefficient to have to monitor all the activities and habits of every employee.
However, UBA can help with security when it is used for a specific investigation.
If you consider your personal home as an example. You may have monitoring tools in every corner and door of your home, with cameras in every single room, but you would still lock your door at night or at the very least not leave your keys on display for anyone to grab. This is because, no matter how much you monitor people, you can’t stop people from stealing your belongings or violate your personal space in any other words. What all those cameras and other monitoring tools do enable you to do, however, is make sure that you can instantly identify a culprit when something does go wrong.
Staying with the home analogy, it is unlikely that having lots of monitoring tools all over your house will also enable you to recover something that is stolen from you. Even if you really know every single corner, every loose floorboard of your property, if you know exactly where all the doors in your house are and which ones are open, and you know exactly where you place each of your belongings and therefore which one is missing, you still won’t know where they will have gone.
IT leaders, therefore, need to recognize UBA for what it is: a very useful tool in the field of technology, but not the be all and end all to keep everybody safe. They must have various other preventive security measures in place to ensure it is nearly impossible for unwanted people or hackers to come in first.