Pass your certification exam. Faster. Guaranteed.

Session Management and Accountability Transcription

Welcome to our session management and accountability module. It is important to make sure that we are managing users' sessions appropriately to ensure the security of our systems. Once a user is authenticated and has logged into the system, their configuration profile will be loaded to determine what resources they have access to and any settings that need to be applied.

The Department of Defense requires that users close their computer sessions by removing their common access card, or CAC whenever they walk away from the system. Most business environments will require users to lock their system by pressing ctrl+alt+delete and then clicking on lock this computer or using the shortcut key, the Windows Key plus L.

Screensavers are also helpful to lock a system that a user forgot to secure before leaving their desk. They can lock the system after a certain number of minutes of inactivity. And when the user returns to the system, they'll be required to reauthenticate to access a locked system. It is critical that we have logging or auditing in place to make sure that users are accountable for their actions.

We also use these logs to determine if our security controls are being enforced appropriately to detect malicious activity. And once this activity has been detected, we can use the logs to take corrective measures and close any security gaps that we may have previously missed. Once an incident occurs, we can use logs as an investigative tool during the incident response process to determine how the attack occurred and also to determine how we can prevent future attacks.

We have several different ways that we can use auditing in our systems to increase security. We can use real-time auditing to detect intrusions and let our administrators know of potential problems. We can also use SIMs, security information and event management, or security event management systems. These are automated solutions that review our logs and provide alerts to our administrators when they detect an anomaly or other security concern.

You will most likely see the term SIM on the CISSP exam. You should be familiar with the fact that the SIM has the benefit of collecting logs from multiple different servers, systems, and other devices, and correlating them to determine if there are any problems. We can also review logs for past activity manually, this is not ideal because an incident could occur and the attacker could have days, weeks, or even months before someone detects it during a manual log review.

In order to have a well protected environment you should combine all of these types of logging and auditing. In order to detect any anomalies, any incidents, or intrusions, as well as make sure that your employees are properly following your security policies and procedures. This concludes our session management and accountability module.

Thank you for watching.