- Solution monitors user activity across both on-premises Active Directory, as well as Azure AD and Microsoft 365, to detect potentially anomalous behavior that could indicate bad actors are already inside of a network, protecting against ransomware
- Leverages monitoring of critical indicators of compromise to detect and thwart intrusions; advanced analytics track attacks in progress
- Unique approach to Active Directory security protects against modification of Group Policy Objects (GPOs), offline extraction of the AD database, and other attack vectors used to deliver ransomware payloads
ALISO VIEJO, Calif., Oct. 21, 2021 (GLOBE NEWSWIRE) -- Quest Software, a global systems management, data protection and security software provider, today announced the availability of On Demand Audit (ODA) anomaly detection to protect against ransomware by detecting anomalous behavior in hybrid Active Directory (AD) and Microsoft 365 environments. As ransomware remains a prominent threat to organizations, ODA anomaly detection acts as an added layer of defense by detecting significant surges in activity that could be indicative of an attack or compromise so organizations can stop attackers before they get into their environments.
ODA combines monitoring of critical indicators of compromise (IOCs) to detect and thwart intrusions with advanced analytics to detect anomalous increases in user activity that can be indicative of an attack in progress. By automatically analyzing large volumes of events to proactively notify users of irregular or inconsistent behaviors that require investigation, organizations don't have to wait for intruders to make themselves known before acting. This early detection feature allows attackers to be stopped before significant damage occurs. ODA anomaly detection presents anomalies in context to illustrate true threats and speed investigations, eliminating the need to spend days chasing false positives, saving time and resources.
“Ransomware isn’t going away. Attack volume is increasing, and attacks are becoming more impactful,” said Michael Tweddle, President and General Manager, Quest Microsoft Platform Management business. “On Demand Audit anomaly detection enables organizations to fight back and eliminate intruders before attacks can escalate. Having a backup in place is no longer enough; organizations need the kind of protection that puts a spotlight on potentially anomalous behavior before it becomes an all-out attack.”
According to Gartner, “increasingly sophisticated ransomware attacks are specifically targeting backup data and administrator functions.” This includes “stealing of credentials for critical systems accounts” and “attacks on the backup administration console.” 1 CISA MS-ISAC Ransomware Guide prescribes prevention tactics called the system of least privilege: Apply the principle of least privilege to all systems and services so that users only have the access they need to perform their jobs. Threat actors often seek out privileged accounts to leverage to help saturate networks with ransomware.
The solution uniquely approaches AD security monitoring by capturing attempts to compromise the directory as they occur to prevent attackers from gaining a foothold in an environment. Simultaneously, ODA audits user activity across both on-premises AD, as well as Azure AD and Microsoft 365, to detect anomalous behavior that could indicate bad actors already at work inside of a network. This release comes on the heels of Quest’s introduction of Recovery Manager for Active Directory Disaster Recovery Edition, a tool designed to help organizations eliminate the risk of malware re-infection throughout the Active Directory recovery process to minimize the impact of ransomware attacks.
For more information, please visit: https://www.quest.com/products/on-demand-audit/
1Source: Gartner, Detect, Protect, Recover: How Modern Backup Applications Can Protect You From Ransomware, Nik Simpson and Ron Blair, January 6, 2021.
About Quest Software
Quest creates software solutions that make the benefits of new technology real in an increasingly complex IT landscape. Quest helps customers solve their next IT challenge, from maximizing the value of their data, to Active Directory and Microsoft 365 management, and cybersecurity resilience. Around the globe, more than 130,000 companies and 95% of the Fortune 500 count on Quest to become data empowered, deliver proactive management and monitoring for the next enterprise initiative, find the next solution for complex Microsoft challenges, and stay ahead of the next threat. Quest Software. Where next meets now. For more information, visit www.quest.com.
Media Contacts
Emma Conger
Quest Global PR
(213)453-0799
Emma.Conger@quest.com
Mariah Gauthier
Highwire Public Relations
Quest@highwirepr.com
