InDefend Advanced PoC Report for CISO
Uploaded by
rguptaInDefend Advanced PoC Report for CISO
Uploaded by
rguptaCommon questions
Powered by AIInDefend handles device access restrictions by allowing organizations to block access to devices such as USBs, MTP, Bluetooth, and CD/DVDs. The process for configuring these restrictions involves accessing the policy control settings, specifically under Device Policies and Device Policy Template. Administrators can set policies to restrict or grant access to specific devices based on organizational requirements, thereby preventing unauthorized data transfers .
The PoC of InDefend Advanced demonstrated use cases such as installation of ten agents, blocking of USB/MTP/Bluetooth/CD/DVD access, monitoring of web and application activities, tracking SMTP emails and attachments with shadow logs, and alert generation for file uploads based on defined keywords. These use cases address client requirements by ensuring comprehensive monitoring and control over data flow, preventing unauthorized data transfer, and maintaining data integrity and security within an organization .
InDefend's shadow logging for attachments enhances organizational security by creating a secondary record of all email attachments exchanged within the network. This capability allows organizations to retain a copy of attachments for security audits and compliance checks. It aids in identifying unauthorized data sharing and potential data breaches by providing a transparent log of file movements and ensuring accountability in communications. As a proactive security measure, shadow logging is crucial for forensic analysis and maintaining data integrity .
The InDefend Advanced Solution provides full transparency over all the computers of an organization by controlling data and network access. It prevents unauthorized access to removable media devices and unauthorized websites and applications. Key capabilities include monitoring all web activities, application activities, SMTP emails, and all attachments with shadow logs. It also monitors file uploads from the web, generates alerts for file uploads based on specified keywords (such as programming languages), and configures periodical screenshots for monitoring purposes .
InDefend tracks file uploads using its Activity Analytics feature that captures and logs file transfer activities over the web. Alerts are configured for specific keywords through the Incident Detail section where file upload activities can be defined against critical keywords. This allows organizations to set up real-time alerts whenever files containing sensitive or designated keywords—such as programming languages or proprietary terms—are uploaded, thus securing data exposure proactively .
The periodic screenshot monitoring feature of InDefend contributes to enhanced surveillance by providing a visual record of user activity at regular intervals. By configuring agents to capture screenshots every five minutes, organizations can maintain a continuous visual log of operations which is crucial for validating user activity, detecting unauthorized actions, and ensuring compliance with security protocols. This automated feature facilitates oversight without manual intervention, bolstering the organization's ability to oversee digital interactions effectively .
The InDefend system restricts source code uploads by monitoring and alerting on file uploads containing specific keywords associated with source code, such as C, C++, C#, PHP, Dot Net, Java, JavaScript, VB 6, MySQL, Oracle, and MariaDB. These restrictions are implemented over email and application channels, with alerts generated when any uploads match the defined critical keywords .
InDefend Advanced enhances application activity monitoring by providing detailed analytics on all applications running within an organization. This includes tracking user interactions with different software tools and generating comprehensive reports that can be used for productivity analysis, ensuring that unauthorized applications are not being used. The system generates these insights by utilizing the Activity Analytics feature which captures and logs user activities for security and operational oversight .
For Windows, the InDefend Advanced solution requires a minimum configuration that includes Windows 10 Enterprise running on i3 or i5 processors without any antivirus. Prerequisites include enabling .Net framework version 3.5, installing .Net framework version 4.6, and Microsoft Visual C++ 2013 and 2015 Redistributables. For Linux, the tested configuration includes running UB 18.04 on an i3 processor, and it is recommended that Linux machines should have at least an i5 processor for better performance, especially when running resource-intensive applications .
For a full-scale implementation of InDefend Advanced, particularly on machines used for software development, it is recommended to use machines with processors that meet or exceed an i5, as Core2Duo processors are unsupported. Machines used for running Android Studio should have a minimum of i5 processors and 8 GB RAM, with 12 GB RAM being recommended for optimal performance due to its resource-intensity. Additionally, it is stressed to ensure all end-user machines meet the minimum hardware requirements to run InDefend smoothly alongside other software tools .