Organizations could use User & Entity Behavior Analytics (UEBA) to proactively monitor for identity anomalies and quicken detection and response times for identity-based attacks.
Control Type: Technical
Control Function: Detective
With identity based cyberattacks on the rise in the 2020s, there is an increasingly urgent need for advanced identity centric cybersecurity controls. One such feature is User Entity and Behavior Analytics (UEBA). Microsoft’s official documentation defines UEBA as “an advanced cybersecurity approach that uses machine learning and behavioral analytics to detect compromised entities such as firewalls, servers, and databases, as well as malicious insiders and cyberattacks, including distributed denial-of-service (DDoS) attacks, phishing attempts, malware, and ransomware”.
The key goal of UEBA is to build reputable profiles of normal, baseline user behavior in their day-to-day activities. Real time user behavior is compared against this baseline to detect anomalies and scrutinize them to detect signs of compromise. One of the biggest challenges with addressing identity-based attacks is the rapid speed at which adversaries can compromise accounts. Modern digital tools have allowed adversaries to compromise accounts and start pivoting within a matter of seconds. This leaves no time for security staff to sit and analyze logs to find out if accounts have in fact been compromised or not. UEBA replaces this manual work by rapidly decreasing detection time, and providing a proactive solution for addressing identity compromises.
The functionality of UEBA solutions is broken down into two parts:
- User Behavior Analytics (UBA)
- Entity Behavior Analytics (EBA)
UBA addresses human accounts, building profiles on their behavior to serve as user activity baselines. EBA does the same thing from the network side, analyzing activities on non-human entities like servers, apps, and IoT devices and building baselines for their activities. This is an extremely useful feature, as one common mistake made in modern environments is completely forgetting about non-human entities as an avenue for account compromise.
UEBA has great potential for integration with other cybersecurity features to build a highly automated blue team and incident response architecture. SIEM and EDR/XDR systems can provide additional context to feed UEBA decisions on whether anomalies indicate compromise or not. SOAR systems can be invoked after an attack is confirmed to automatically start remediation measures. As UEBA continues to mature and expand its capabilities, more such implementation opportunities will emerge.