The Challenge

The myriad of compliance regulations create ongoing challenges for enterprises in every industry and many companies must meet multiple requirements for internal controls (SOX), payments data security (PCI DSS), patient health information (HIPAA) and other industry specific requirements (GBLA, NERC/FERC and FISMA/NIST SP 800-53). Common to every major compliance regulation and industry mandate are requirements to ensure users authenticate with a unique identity, privileges are limited to only ones needed to perform job functions and user activity is audited with enough detail to determine what events occurred, who performed them and the outcome.

In addition, mitigating the risk of insider attacks that can lead to a data breach or system outage remains a key concern for security managers. One report from US-CERT (with cooperation from the U.S. Secret Service) estimated that 86% of internal computer sabotage incidents are perpetrated by a company’s own technology workers and 33% of participants in the 2011 CyberSecurity Watch Survey responded that insider attacks are more costly than external ones.

Closely related to the insider threat are the concerns that arise as enterprises, who are being driven to find cost efficiencies at every level of their operations, increasingly turn to outsourcing, off-shoring and cloud computing. These organizations are still responsible for the security and compliance of their IT systems, even as their visiblity into how those systems are being used is diminishing.

The Centrify Solution

Centrify DirectAudit for Windows enables detailed, real-time auditing of privileged user sessions on Windows systems, providing a full accounting of user activity and system access. DirectAudit's detailed capture of historical user activity establishes accountability and advances compliance reporting by recording which users accessed which systems, what commands they executed, with what privilege, and the exact changes they made to key files and configurations.

With DirectAudit, enterprises can report on historical user activity, pinpoint suspicious activity through real-time monitoring, and troubleshoot system failures by replaying actions for root-cause analysis. DirectAudit is a comprehensive solution for user activity and session auditing that supports an array of popular protocols used to access privileged systems, provides easy search and replay for auditors and managers and integration into established tools and processes used by personnel in security and network operations centers, helpdesk staff and teams monitoring service levels of third-party vendors.

Centrify DirectAudit for Windows is unique in its ability to provide a Windows auditing solution that is seamlessly integrated with UNIX and Linux server auditing as well. The same architecture that you deploy to audit Windows servers can also collect and store privileged user sessions on UNIX and Linux servers, providing your IT security and compliance managers with a unique, "all in one" view of privileged activity across all of your business-critical systems, regardless of platform.

Learn More

Next Steps