A company is concerned about advanced persistent threats and wants to implement a security solution that can detect any unusual actions. The company…

User and Entity Behavior Analytics (UEBA) is a security technology specifically designed to detect insider threats, compromised accounts, and advanced persistent threats (APTs). It operates by establishing a baseline of normal, everyday behavior for users and entities (e.g., servers, endpoints) within a network. Using machine learning and statistical analysis, UEBA continuously monitors activity and identifies anomalous actions that deviate from this established baseline. This capability directly addresses the company's requirement to analyze user and entity actions and trends to detect unusual activities that could signify a security risk.

B. Hardware security module (HSM): An HSM is a specialized hardware device used to safeguard and manage cryptographic keys. It does not analyze user behavior or detect threats.

C. Antivirus tools: Traditional antivirus software primarily relies on signature-based detection to identify known malware and is often ineffective against the novel or fileless techniques used by APTs.

D. Two-factor authentication: This is a preventative access control measure that strengthens user authentication. It does not monitor or analyze user behavior after successful authentication.

1. Microsoft Official Documentation. (2023). Identify advanced threats with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel. Microsoft Learn. In the introduction, it states, "UEBA analytics enables you to identify and analyze anomalous user behavior... to help you determine if a compromise has occurred." This directly supports the use of UEBA for detecting unusual actions indicative of advanced threats.

Reference: Section: "Overview," Paragraph 1.

2. Al-Hawawreh, M., & Moustafa, N. (2022). A Survey of User and Entity Behavior Analytics for Cyber Security. IEEE Transactions on Network and Service Management, 19(4), 4675-4695. This peer-reviewed paper defines UEBA as a system that "builds profiles of users and entities based on their historical activities... to detect anomalies and potential threats."

Reference: Section II.A, "UEBA Definition and Architecture," p. 4677.

DOI: https://doi.org/10.1109/TNSM.2022.3185188

3. Carnegie Mellon University, Software Engineering Institute (SEI). (2017). Common Sense Guide to Mitigating Insider Threats, Fifth Edition. CMU/SEI-2017-SR-001. The guide discusses behavioral analysis as a key practice, stating, "Monitor and audit employee online actions... to look for anomalous behavior." UEBA is the technology that automates and scales this practice.

Reference: Practice 15: "Implement strict access controls and monitoring policies on privileged users," p. 49.