Section 21.206 User Behaviour Analytics

Question 1

User Behavior Analytics (UBA)

Answer 1

Advanced cybersecurity strategy that uses big data and machine learning to analyze user behaviors for detecting security threats

■ Focuses on understanding user behavior within systems and networks to identify patterns and anomalies

Question 2

User and Entity Behavior Analytics (UEBA)

Answer 2

Technology similar to UBA but extends the monitoring of entities like routers, servers, and endpoints in addition to user accounts

■ Enhances security by analyzing both user and entity behavior to detect
anomalies

Question 3

Key Aspects of UBA and UEBA

Answer 3

UBA leverages data analytics to collect and analyze user behavior data to establish normal behavior baselines

● Knowing the baseline makes it easier to spot anomalies

■ Machine learning algorithms are used to identify deviations from normal behavior, which may indicate security threats

■ UBA systems process data from various sources:
● Network traffic
● User devices
● Application logs

■ Alerts are generated when anomalies are detected, which are then investigated by the security team

Question 4

Benefits of UBA and UEBA

Early Detection of Threats

Answer 4

UBA tools can identify potential threats before significant damage occurs, allowing for quicker and more effective responses

Question 5

Benefits of UBA and UEBA

Insider Threat Detection

Answer 5

Effective at identifying insider threats by detecting suspicious activities that deviate from typical behavior

Question 6

Improved Incident Response

Answer 6

Provides detailed information about user behavior, helping security teams
respond effectively to incidents, such as compromised credentials or unauthorised actions