Monitor System Changes And User Activity

Detect System Changes
and User Activity in Real
Time June 2007

Contents
Introduction ........................... 1 Monitoring for changes and user activity is often considered a The Push for User Activity best practice in IT, and is even mandated by requirements such and Change Monitoring........ 1 as the Payment Card Industry Data Security Standard (PCI-The Broadening Regulatory DSS). Unfortunately, current approaches such as native auditing, Landscape ......................... 2 file integrity checking or kernel shims often fail to meet the Synopsis of Recent Public changing threat landscape, manage the proliferation of regulatory Security Breaches ............. 3 mandates or map to the requirements of the business. This whitepaper will present a new solution offering, NetIQ Common Approaches to Change Guardian for WindowsT, and will discuss how it Monitoring Servers................ 4 overcomes the challenges of common approaches to change and Where Traditional Monitoring activity auditing on your Windows servers-all without the need Approaches Fail ................ 4 for native auditing. In this paper you will learn: What's Needed to Bring ;Monitoring Solutions Back Why organizations are having to perform more detailed to Par................................. 7 monitoring of their files and the activities of their users ; Recent, well-publicized events that show where current An Improved Approach to approaches to system security monitoring have failed Monitoring User Activity and ;Changes in Real Time ........... 7 How NetIQ Change Guardian for Windows provides Introducing NetIQ Change invaluable, real-time insight into what is going on across Guardian for Windows...... 7 your Windows servers-all without the need for performance-hindering native auditing Summary .............................. 12
About NetIQ Corporation .. 12
NETIQ CORPORATION PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS STATEMENT MAY NOT APPLY TO YOU. This document and the software described in this document may not be lent, sold, or given away without the prior written permission of NetIQ Corporation, except as otherwise permitted by law. Except as expressly set forth in such license agreement or non-disclosure agreement, no part of this document or the software described in this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of NetIQ Corporation. Some companies, names, and data in this document are used for illustration purposes and may not represent real companies, individuals, or data. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in or changes to the software described in this document at any time. © 1995-2007 NetIQ Corporation, all rights reserved. U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), in accordance with 48 C.F.R. 227.7202-4 (for Department of Defense (DOD) acquisitions) and 48 C.F.R. 2.101 and 12.212 (for non-DOD acquisitions), the government's rights in the software and documentation, including its rights to use, modify, reproduce, release, perform, display or disclose the software or documentation, will be subject in all respects to the commercial license rights and restrictions provided in the license agreement. Check Point, FireWall-1, Provider-1, SiteManager-1, and VPN-1 are trademarks or registered trademarks of Check Point Software Technologies Ltd. ActiveAgent, ActiveAnalytics, ActiveAudit, ActiveReporting, ADcheck, AppAnalyzer, AppManager, the cube logo design, Directory and Resource Administrator, Directory Security Administrator, Domain Migration Administrator, Exchange Administrator, File Security Administrator, IntelliPolicy, Knowing is Everything, Knowledge... [download for more]