7. Reporting (DSI)
Summary
Reporting and intelligence are essential components to a successful information security program. Smartcrypt’s data security intelligence allows enterprise security teams and audit/risk personnel to track which files were encrypted, the users who accessed them, what devices they were on, and where these events took place. This data can be reported on directly through the data security intelligence interface in the Smartcrypt Manager, picked up by a SIEM agent or retrieved via API for transformation and load to a customer data-mart.
Events
Event | Event Description |
---|---|
Account Transfer | Account Transfer is an event triggered when an account is logged into a new device on the first login. This event is different than a normal login because this event transfers the user's encrypted metadata to the device to be decrypted by the Smartcrypt Agent for use with Smartcrypt. Sample JSON
CODE
|
Add Certificate | When a System Administrator or Security Administrator adds a new contingency key into the system to be used with a policy, the Add Certificate event is stored by the Smartcrypt Manager. Sample JSON
CODE
|
Add Smartkey | When a user creates a new Smartkey on any device, the event is captured in the Data Security Intelligence reporting. Sample JSON
CODE
|
Allow | When a user requests access to a Smartkey, an access request is posted (and emailed) to the owner of the Smartkey. When the owner responds with an allow (giving the participant access to the Smartkey and thus decryption/encryption abilities), this event is stored noting the access being given. Sample JSON
CODE
|
Create Account | When a new user accesses Smartcrypt for the first time, the Smartcrypt Manager needs to create an account for the user. The account is created by the Smartcrypt Manager and this event captures the date and time when it occurred. Sample JSON
CODE
|
Create Community | System Administrators and Security Administrators can create Community Keys within the Smartcrypt Manager based on groups of individual user objects stored in Active Directory. The event is stored in the system to capture the creation of a new Community Key being available in the system. Learn more about Community Keys here. Sample JSON
CODE
|
Create Locker | A System Administrator and Security Administrator can create a Locker on a Smartcrypt Device to create a protected folder on a device. Data Security Intelligence captures this event to show when a folder started being protected. Learn more about Lockers here. Sample JSON
CODE
|
Create Policy | A System Administrator and Security Administrator can create a policy to control how users will interact with the Smartcrypt product deployed on their desktops/servers. A Create Policy event shows the time, date, and the login information for the Administrator who defined the policy. Learn more about policies here. Sample JSON
CODE
|
Delete Community | System Administrators and Security Administrators can delete Community keys within the Smartcrypt Manager. This is very dangerous activity to do because existing data encrypted with the community key will no longer be able to be decrypted by the Community key. This event will capture what Administrator deleted the Community Key as well as the date and time. Learn more about Community Keys here. Sample JSON
CODE
|
Delete Locker | A System Administrator and Security Administrator can delete a Locker on a Smartcrypt Device. This event does not cause the data to be decrypted in the locker, but only stops the automatic encryption from occurring on the next plain-text file discovered in the locker. Data Security Intelligence captures this event to show when a folder stopped being protected. Learn more about Lockers here. Sample JSON
CODE
|
Delete Policy | A System Administrator and Security Administrator can remove an existing policy from the system. This will remove the controls in place for the defined set up uses that were using the Smartcrypt application. The event stores the date, time and login name of the Administrator who deleted the policy. Learn more about policies here. Sample JSON
CODE
|
Deny | When a user requests access to a Smartkey, an access request is posted (and emailed) to the owner of the Smartkey. When the owner responds with Deny (blocking the participant access to the Smartkey and thus not allowing decryption/encryption abilities), this event is stored noting the access is being denied. Sample JSON
CODE
|
Issue Access Token | Smartcrypt clients need to be authenticated to communicate with the Smartcrypt Manager. The application will take care of this behavior for the user by getting an access token. The server can refuse to give any device an access token, which will force the device to be disabled. This event captures the event of a specific device communicating with the Smartcrypt Manager and receiving a token for access. Sample JSON
CODE
|
Login | When a user logs in on a device (not first time login, that is called "Account Transfer"). This event proves the user is accessing the device and authenticating with the Smartcrypt Manager. Sample JSON
CODE
|
Smartcrypt Show Passphrase | To allow Smartkey-encrypted archives to be decrypted by an external third-party application, a passphrase can be extracted from the archive to enable the archive to be decrypted and extracted. This event captures the user, device, time and date when the passphrase was generated for a given archive. Sample JSON
CODE
|
Smartcrypt Decrypt | When any user decrypts an archive, the Data Security Event captures information about the decryption. Attributes included are filename, archive name, method of decryption, policy controlling user, device information, date and time of the event. Sample JSON
CODE
|
Smartcrypt Encrypt | When any user encrypts an archive, the Data Security Event captures information about the encryption. Attributes included are filename, archive name, method of encryption, policy controlling user, device information, date and time of the event. Sample JSON
CODE
|
Update Community | System Administrators and Security Administrators can create Community keys within the Smartcrypt Manager based on individual user objects stored in Active Directory. Over time, access to the Community Key can change which will result in a Smartcrypt Update event being stored logging the change. Learn more about Community Keys here. Sample JSON
CODE
|
Update Locker | A System Administrator and Security Administrator can update a Locker on a Smartcrypt Device to create a protected folder on a device. The update could include which key to be used, or even what folder path to protect. Data Security Intelligence captures this event to show when a folder started being protected. Learn more about Lockers here. Sample JSON
CODE
|
Update Policy | A System Administrator and Security Administrator can update an existing policy from the system. This action has the potential to remove the controls in place for the defined setup users that were using the Smartcrypt application, or add controls to different users who were added to be incorporated into the policy. The event stores the date, time and login name of the Administrator who updated the policy. Learn more about policies here. Sample JSON
CODE
|