o

1. Introduction

Data breaches are a serious threat to any organization and so appropriate action must to be taken to keep the risk of these threats to a minimum. The focus at Lepide is to provide visibility over what’s happening with your data and through visibility you can take the necessary steps to mitigate risk and stay compliant.

This guide is in two parts. The first explains the ways in which you can use Lepide Data Security Platform to reduce the chance of a data breach in the case of files being copied. The second section gives step-by-step instructions on how to configure the solution to meet your requirements.

2. Why Monitor the Copying of Files?

The ability to copy files is an essential requirement to many job roles within an organization.

However, when this functionality is misused and file copying activity is done for the wrong reasons, data security is compromised, and appropriate remedial action needs to be taken. To combat this ever-increasing insider threat of a data breach, it is essential to monitor all file activities, especially file copy actions, to spot malicious activity at the initial stages. While the constant monitoring of user behavior is achievable, it can be complex and time consuming without the right solution in place.

3. The Solution

The Lepide Data Security Platform provides a solution to this. It works in real time and allows you to view a summary of employee activity within a given timeframe to see which files have been copied.

It also provides the ability to set up real-time alerts so that immediate action can be taken. For example, if a certain number of files are copied in quick succession, this could indicate the start of a data breach. In this case, an alert would be triggered, and an immediate response implemented.

Once there is visibility is in place to warn of potential threats, action can be taken to reduce risk and remain compliant.

3.1 The File Copy Report

The summary of user file copy activity is provided using the File Copy Report. This report will show file copying activity within a given time scale and can be further filtered to focus on whatever data is required.

3.2 The Mass Data Copy Threat Model

This Threat Model can be activated and then customized to meet specific requirements. As well as providing an alert to suspicious activity, it can also be configured to respond to an event which could be, for example, to shut down a file server or revoke a user’s permissions.

4. Configuring File Copy Reporting and Alerting

4.1 Prerequisites

Before reporting and alerting on files being copied, you will need to have added and configured https://lepide.atlassian.net/wiki/spaces/LEPKB/folder/3829497867?atlOrigin=eyJpIjoiYTE1OGJiYzdlNTM5NDYxMTgxOTgzMDM3YTU0MTlhZDQiLCJwIjoiYyJ9 to enable auditing.

Once this has been configured, you will immediately see all file copy events as the Lepide Data Security Platform provides alerting and reporting in real time.

4.2 Running the File Copied Report

• From the Lepide Web Console home page select Lepide Auditor

• From the list of Auditor Reports, expand File Server and select Files Copied

• The Files Copied report is displayed:

4.2.1 Specify a Date Range

• From the top of the screen, click on the date to choose a date range for the report

The following dialog box is displayed:

• Select a date range from the list

• Click Generate Report

The report runs and shows information including who copied the file, what was copied and the location of the file.

4.2.2 Filtering the Report

To add filters to the data, click on the filter area above the relevant column and type in the information you want to see.

For example, you may want to see data for a particular user - so click at the top of the Who column and type in the username:

In the example below, the report has been filtered to show both data for Neal and where the file type is txt.

The report can be scheduled, saved, and exported.

4.3 Threat Models

Real time alerts can be generated whenever a potential threat is detected by enabling one of many pre-defined Threat Models within the Lepide Data Security Platform.

To see all the threat models available, select Lepide Detect:

The Threat Models can be enabled as needed. They can then be configured to generate an alert and respond to a threat.

4.3.1 Responding to a Threat

Once an alert has been received, automated scripts can be executed to speed up the response time and address any threats immediately. Using custom script execution, user accounts and/or file servers can be shut down and other actions taken to prevent a potential data breach.

4.4 How to Enable and Configure the Mass Data Copy Threat Model

• From the Alert Configuration window, click the Edit icon

  

  next to the Mass Data Copy Threat Model

The Edit Alert dialog box will be displayed:

• Slide the Status button to the right to enable the threat model

• This is the start of a wizard. Click Next to continue

The Set Filter(s) dialog box enables you to set up an alert.

On the left of the dialog box, you can see the Threat Model you are working on which is Mass data copy (FS).

There are options to change the settings for Server, User, Object Name, Object Path, Operation, Process and From using the drop down menu. The default setting for all these options is All.

The threshold alert options can be customized as follows:

• Click Next

The Alert Settings dialog box is displayed:

This dialog box allows you to set up responses to occur when an alert has been triggered and it displays any existing responses which have been set up. You can also change the Alert Type.

To create a new response to an alert, click the Add Action button.

The Add Alert Action dialog box will be displayed:

Click the Select Action drop down arrow to see a list of actions available:

The configuration of each of these actions is explained below:

1. Send Email Alert

This option allows you to send an email once an alert has been triggered. The elements of the dialog box are as follows:

Sender’s Email Account: The Sender’s email account will be displayed here if it has been selected. Click Add New Email Account to enter a new Sender’s Email Account. Further information on how to add a new email accounts is shown in Section 3.2.1 of this guide.

Recipient Email(s): Add recipient emails by typing the email addresses into the box. If there are multiple email addresses. separate them with a ‘,’

Send Email to user: Check this box to send an email to the user. The content of the email can be typed into the text box. To include the username within the content, use the variable %USERNAME%. Note that this option is only applicable to File Server alerts.

Send Actions for past xx days: This option allows you to see everything that this user has done over the last number of specified days. For example, if an alert is triggered because they have been copying files, then you may want to see what else they have been doing. Check this box and specify the number of days and an email will be sent with an attachment listing everything that the user has done over the specified number of days.

The attachment will contain a report and the format(s) can be specified by checking the relevant box. The formats are CSV, MHT and PDF.

• Click Done to save the alert action.

4.4.1 Add an Email Account

• Select the Add New Email Account button

The following dialog box is displayed:

• Add the following information:

  • Display Name

  • Sender’s Email Id

  • Check the Requires authentication box if required

  • Logon Name

  • Password

  • Server Name/IP

  • Port

  • Check the Requires a secure connection (SSL) if required

• Select Send Test Email to check that all the settings have been added correctly

• Click Done when finished

• You will return to the Configure Report Delivery Action dialog box

• Select the Sender Email Account

• Click Done when finished

2. Send on Lepide AI (LiveFeed)

Send on Lepide AI (LiveFeed) means that the alert will be sent to Lepide AI. An example of this is shown below:

• Click Done to switch the LiveFeed alert on.

3. Send Alert to App

The Send Alert to App option sends the alert to a mobile device.

4.4.2 Add an App Account

• Click the Add App Account button to add a new mobile account. The following dialog box is displayed:

• Enter the User ID and Password

• Enter the Mobile App ID which is generated by using the mobile device to scan the QR code displayed at the bottom of the dialog box.

• Click Done when you have finished adding the account. You will return to the Configure Report Delivery Action screen

• Select the newly added account from the list

• Click Done when finished

4. Execute Script

Execute Script gives the option to execute one of the predefined PowerShell scripts when an alert is triggered.

The elements of the dialog box are as follows:

• File Path: Enter the file path of the PowerShell script

  • Choose either:
    Run with SYSTEM account or
    Run with selected account.
    
    If you choose Run with selected account, you can use the drop-down to select the account or click Add Account to specify the account to be used.

• Choose Notify me when a script is executed to send an email on script execution.

When this option is checked, the Configure button becomes available. Choose Configure to set up the sender’s account and recipient’s email address.

• Choose Parameterized input file contains to specify a variable to include in the script. When this option is checked, a drop-down menu becomes available to choose a variable:

• Click Done to return to Edit Alert dialog box and details of the alert will be displayed

• Click Done when finished and the alert will be created

5. Send Alert to SIEM

• The Send Alert to SIEM option allows you to add a SIEM account and send an alert to the SIEM

4.4.3 Add a SIEM Account:

• Click the Add SIEM Account button to add details of your SIEM account

The following dialog box is displayed:

• Add the Name, IP Address and Port Number for the SIEM account

• Check the CEF Format box if required

• Click Submit

This will take you back to the Configure Report Delivery Action screen.

• Select the SIEM account and click Done when finished

• Click Done to return to Add Alert dialog box and details of the alert will be displayed

• Click Done when finished and the alert will be created

• Click Done when finished to return to the Alert Configuration screen