Netwrix: Unrivalled Audit Data Solutions for IT Systems

Established in 2006, Netwrix is an IT security software company that provides IT auditing solutions for applications and systems across the IT infrastructure. While Netwrix is primarily located in Irvin, California, its operations span Europe, the Middle East and Africa (EMEA) as well as the Asia Pacific region. The company's primary focus is IT auditing in which case it specializes in access, configuration, and change auditing. This is achieved using Netwrix Auditor solution, which is the company's core product ( Coffey, 2017 ; Crosier, 2015). The tool’s latest version is Netwrix Auditor 9.8. The Netwrix Auditor Platform focuses on audit data solutions for IT systems. Besides offering IT auditing solutions, Netwrix provides solutions in other areas, including business continuity, operations management, and lastly, compliance and security ( Coffey, 2017 ) . Moreover, the company offers data access and aids in the preparation of reports that are used to pass compliance audits. It's also involved in increasing the efficiency of IT operations in companies. Netwrix’s range of products is applicable in such sectors as finance, health, education and government. This paper is aimed at exploring Netwrix Auditor, which is the company's flagship and core audit tool. 

Netwrix Auditor 

The Netwrix Auditor offers total visibility on who altered what, where, and when. It also provides information on which individual has access to what in a company’s IT infrastructure. The tool makes all changes and configurations made to the infrastructure visible using a single console (Crosier, 2015). This is possible even if there is a lack of production of logs. The Netwrix Auditor provides a unified platform and boasts several key features. 

The Scope and Benefits of Netwrix Auditor 

Security Intelligence 

The auditor delivers comprehensive intelligence on all activities taking place in IT environments (Coffey, 2017). In pursuit of this, the tool identifies the users that have the most anomalous activity after which it provides alerts on the behavior patterns that are indicative of a likely threat. Consequently, this makes investigations into any security policy violation or suspicious activity easy, which leads to a quick determination of the most appropriate response. 

Sensitive Data 

Netwrix Auditor helps in identifying particular folders and file shares that contain sensitive files. This facilitates the prioritization of security for these critical assets ( Poh et al., 2017 ). The tool also helps in ensuring that only authorized individuals can share, view, delete, or edit the files. Further, it aids in carefully monitoring any activity capable of jeopardizing the security of all sensitive information. Lastly, the tool is useful in the detection of any sensitive data surfaces occurring outside of the location that is deemed secure. 

Continuous Assessment and Mitigation of Data Security Risks 

By identifying high-risk events, the auditor ensures that they are given immediate attention (Poh et al., 2017). To reduce the chances of unauthorized entities causing damage, a company has to pay attention to its permission settings. 

Data Breaches and Abuse of Privilege 

The auditor provides a comprehensive image of all user permissions in a bid to prevent data breaches (Crosier, 2015). Likely remedial actions in this regard include locking down all the overexposed data and making sure that it is only the eligible persons that can access the critical resources. Moreover, there is a need for the concerned personnel to remain aware of the modifications that may affect user privileges. This increases the feasibility of immediate response in case of anything. 

Increased Awareness of Activities Taking Place in the IT environment 

Netwrix Auditor provides a comprehensive perspective of everything that is taking place in a company’s hybrid IT infrastructure ( Poh et al., 2017; Mansfield-Devine, 2014 ). This is aided by enterprise overview dashboards. This enables one to spot any surges in anomalous as well as identify the most active user. Lastly, it helps in identifying the most affected systems. 

Identification of Possible Threats 

The Netwrix Auditor aids in the quick identification of elusive signs of likely threats ( Coffey, 2017 ). These could include unusual logons which could be indicative of user identity theft or a dissatisfied privileged user seeking to conceal his or her activity behind particular accounts. Blindspot analysis reports and user behavior ensure that any malicious activities are identified easily identified. 

Real-time Threat Pattern Alerts 

Using the Netwrix Auditor ensures that one is alerted about any unauthorized activity as it takes place, which ensures that he or she can prevent the breach. For instance, one can opt to receive notifications when a new member is added to the Enterprise Admins group. A notification can also be sent when one user modifies numerous files within a short duration. This is because such an event could hint at a ransomware attack. 

Centralized IT Security Monitoring 

Feeding the auditor cloud-based data helps in centralizing both security monitoring and planning. Consequently, any data that can be acted upon is used in enhancing security. 

Archiving of Security Analytics Data 

The AuditArchive storage helps an entity keep its audit data archived for either security investigations or e-discovery. This form of storage is two-tiered and features SQL database coupled with the fact that it’s file-based. 

Compliance 

The tool helps in boosting compliance with various standards and legislation. These include; 

Payment Card Industry Data Security Standard 

Sarbanes-Oxley Act (SOX)

Federal Information Security Management Act (FISMA) 

ISO 27001; and Gramm-Leach-Bliley Act (GLBA).

Family Education Rights and Privacy Act (FERPA)

North American Electric Reliability Corporation (NERC) 

General Data Protection Regulation (GDPR) 

Criminal Justice Information Services (CJIS) 

Health Insurance Portability and Accountability Act (HIPAA) 

California Consumer Privacy Act (CCPA). 

Netwrix Auditor as a Unified Platform 

Netwrix offers a unified platform that can be used to monitor activity across both backbone and data storage systems. This aids customers in understanding the location of sensitive data, the risks associated with it, and the event responsible for the security threat ( Coffey, 2017 ; Alhosban, 2015 ; Crosier, 2015) . As a unified platform, Netwrix is applicable in various contexts as highlighted below; 

Active Directory 

Netwrix Auditor offers security intelligence covering all the happenings in the Active Directory as well as Group Policy. This makes auditing of logins and changes made to the Active Directory possible. The audit helps to prevent privilege abuse, enhance troubleshooting, and strengthen IT compliance. 

Office 365 

The auditor provides complete visibility to Microsoft Office 365's hosted Exchange component. This helps mitigate the security risks associated with Office 365. Any changes made to the organization of Exchange Online can also be tracked and reported. 

Windows File Servers 

The auditor provides complete visibility into all that is taking place in the file servers by providing actionable data. It also offers reports on the successful as well as failed access efforts. 

Windows Servers 

Using Netwrix Auditor, one can get a complete image of all server infrastructures, especially those that are windows-based. In this pursuit, the tool detects and reports any changes to the servers. 

Exchange  

The Netwrix Auditor provides complete visibility to the Microsoft Exchange infrastructure. This is achieved by monitoring all alterations to the exchange, including those done on permissions to the public folder. 

SQL Server 

The auditor is useful in delivering complete visibility into an entity's Microsoft SQL environment by reporting coupled with tracking all changes made to this environment’s elements. 

Azure Active Directory 

The tool aids in generating audit data on Azure Active Directory’s activities and changes that can be acted upon. In this case, Netwrix Auditor for the Azure AD ensures that one can quickly investigate and detect the incidences that are likely to threaten cloud security and which may result into a downtime ( Poh et al., 2017; Aswini & Mervin , 2016) . 

Vmware 

Using the auditor, one can obtain information on any alterations to the vSphere. This includes the standalone ESXi hosts. Thus, performing regular audits on the VMware helps in hardening security, optimizing operations, and proving IT compliance. 

SharePoint 

The auditor, in this case, offers security intelligence on what's taking place in the SharePoint environment. In this case, information on those with access to this environment helps in tracking changes made, thus reducing any risks of data leakage. 

Network Devices 

The auditor makes configuration changes made to Fortinet as well as Cisco devices visible. Likewise, all logons, whether failed or successful, are made visible. 

Oracle Database 

Any access and alterations made to the Oracle Database are made possible by the Netwrix Auditor. 

EMC A udits 

This auditor helps enterprises in strengthening data security, increasing operational efficiency, and streamlining compliance. In particular, it facilitates enhanced visibility into the storage environment. This is achieved by tracking the changes made to shares, folders, and files. 

NetApp 

This auditor offers full visibility into all the activities taking place in the file storage. In this pursuit, the auditor provides granular audit data and features deep insights into alterations made to permissions, shares, and folders, whether successful or not. 

Cost and Comparable Tools 

Netwrix Auditor boasts two main pricing plans. Thus, the tool is accessible via a free trial or through a quote-based plan. For instance, the tool's enterprise pricing is only available upon request. Nevertheless, the tool is licensed based on the number of Active Directory (AD) user accounts. Pricing for the tool is subscription-based and begins at $12 per individual AD user. Alternatives to the Netwrix Auditor include the Salesforce Platform, Seebo, Atera, AirWatch MDM, EventLog Analyzer, DataSense, Traverse Monitoring, ClouderPC, Iguana, IBM MaaS360, InVision, Probe.ly, SysToolsEDB to PST Converter, Platfora, Ezeelogin SSH Jump Server, C3 IoT Platform, Bomgar Remote Support, and System Frontier among others. 

Software P re-requisite I nformation 

The Netwrix Auditor supports particular data sources. Thus, the tool can only monitor limited systems. These systems include; 

Active Directory Domain Controller OS versions

Azure Active Directory version that is offered by Microsoft Office 365

Microsoft Exchange Server s 2010 ( SP1 and above ), 2013, 2016 

Exchange Online version provided by Microsoft Office 365

Windows file servers

Windows Server OS ( 2008 SP2 , 2008 R2 , 2012/2012 R2 , 2016, 2019) 

Windows Desktop OS ( Windows 10, Windows 8.1, Windows 7) 

Network services ( Cisco devices , Fortinet Fortigate , SonicWall , Juniper Networks , and Palo Alto ) 

EMC

NetApp

Oracle Database

SharePoint and SharePoint Online

SQL Server

Vmware

Event Log ( Windows Server OS and Windows Desktop OS ) 

Windows server (Windows server OS, Windows Desktop OS ) 

DNS

DHCP

Netwrix Auditor also supports technology integrations, thus leveraging the integration API. The applications and systems supported in this case include RADIUS server , Amazon Web Services , Cisco devices , and Syslog devices . Full installation of the tool requires both Netwrix Auditor client and Netwrix Auditor Server. The hardware configuration chosen is dependent on the size of the monitored environment, coupled with the number of activity records that the tool records per day. The tool can be deployed on a virtual machine that is running Microsoft Windows guest OS on a virtualization platform. Examples of platforms include VMware vSphere, Microsoft Hyper-V, or Nutanix AHV. The supportive software, on the other hand, consists of an operating system, .NET framework, and an installer. 

Conclusion and Recommendation 

Netwrix Auditor is undoubtedly one of the best governance and visibility platforms focused on IT operations and security across departments and teams. It is useful in various sectors including education, financial services, healthcare, technology, public sector, and industrial organizations, among others. The tool is not only easy to configure but also to use. This enables its users to quickly detect data security risks and threats in their IT environments. This is achieved through monitoring access to data and generating reports on any changes made by employees or users to configurations, server and files in the IT system. Apart from acting as an auditing solution, the tool plays a crucial role in increasing the productivity of an entity's IT department. To maximize the benefits of Netwrix Auditor, it is recommended that a user is aware of his or her needs and thus is careful when choosing a Netwrix Auditor product. This is vital in ensuring that maximum benefit is obtained. 

References

Alhosban, A. (2015). Role for Internal Auditor to Cope with IT Risks and IT Infrastructure in Jordan Commercial Banks.  Global Journal of Management And Business Research . 

Aswini, G., & Mervin, R. (2016). A Survey on Cloud Security Issues and Threats. 

Coffey, J. W. (2017). Ameliorating sources of human error in cybersecurity: Technological and human-centered approaches. The 8th International Multi-Conference on Complexity, Informatics, and Cybernetics, Pensacola , 85-88. 

Crosier, K. (2015). Behind the Software Q&A with Netwrix CEO Michael Fimin. Retrieved from https://www.business-software.com/blog/netwrix-interview/ 

Mansfield-Devine, S. (2014). Not coping with change.  Network Security ,  2014 (8), 14-17. 

Poh, G., Baskaran, V., Chin, J. J., Mohamad, M., Lee, K. W., Maniam, D., & Z’aba, M. (2017). Searchable Data Vault: Encrypted Queries in Secure Distributed Cloud S torage.  Algorithms ,  10 (2), 52.