Join us on April 7-9, 2021

The first industry event focused on data engineering

Register Today
All Blog Posts

User Behavior Analytics: Best Defense for Internal and External Threats

October 12, 2016

User behavior analytics (UBA) has grown in tandem with big data over the last decade. As the amount of data increases and hacking continues to be a top concern for today’s large companies, UBA will only become more valuable. Still, not all UBA threats are considered equal, and much of the critical work centers around how quickly risk can be assessed.

That’s where big data analytics tools that can wrangle petabytes in real-time become invaluable.

Internal Threats / External Threats & User Behavior Analytics

Behavior analysis came on the scene in the early 2000s and was leveraged by marketing teams to examine and forecast consumer behavior. Nowadays, the definition of user behavior analytics applies more readily to the work of an organization’s security team, and it is broadly defined as the tracking, collecting, and assessing of user data and activities in order  to detect potential threats to a company’s security systems.

To identify malicious traffic patterns, a UBA tool must first determine a baseline of behavior and define it as “normal.”  From there, user behavior analytics identifies deviations from the norm through big data and machine learning algorithms. These insights are then leveraged by a company’s security team to take action. That is why finding and assessing deviations in near-real-time is critical.  

User Behavior Analytics Mitigates Risk in Real Time

User behavior analytics’ advanced profiling and exception monitoring capabilities can be used to detect internal and external threats.

Internal threats, also known as insider threats, are those that come from people within an organization—employees, former employees, contractors, or business associates—who have knowledge of said company’s security practices and procedures. The actual threat may include theft of valuable information or intellectual property, fraud, or even computer system sabotage.

External threats are sometimes referred to as advanced persistent threats (APTs). APTs are stealthy, continuous cyber-hacking processes that intentionally target a specific organization for financial or political gain. The idea is to put custom malware on as many computers as possible, while remaining undetected for as long as possible.

Regardless of whether a threat is internal or external, user behavior analytics works the same way. UBA tools gather data about user roles and titles; definitions of access and permissions; activity logs stored in SIEM systems; geo-located activity; and security alerts, and then examines that data to find outliers.  

Risk in Real Time

Finding user-generated incongruities within a system isn’t enough, however. This is because not all anomalous behavior is, by definition, a risk. Once found, a user’s behavior must then be analyzed for its potential impact on the organization. If a behavior involves less sensitive resources, it would receive a low impact score; if the behavior involved something more sensitive, it would receive a higher impact score.

Determining organizational risk in real time—or near-real-time—is critical for security teams to prioritize follow-up, and it is a process made all the more difficult by the massive amounts of data needing to be assessed.

There is good news, however. Big data tools like Trifacta are increasing user behavior analytics functionality; now, petabytes of data can be examined quickly to detect threats and machine learning algorithms provide more accurate risk intelligence and eliminate false positives.

Learn more about how Trifacta detects corporate fraud within the financial services industry.