For over 25 years, Haystax has been the provider of world-class commercial software products for direct use by individuals in the agencies charged with protecting our communities, cities, and country. Thus, our product is one of the most widely deployed risk management software solutions, used by school, law enforcement, fire, emergency management, and other government agencies across the United States.

Image module

Haystax for School Safety

Haystax meets the constantly evolving challenges of providing safe learning environments for students, faculty, staff, and local security partners by integrating all vital incident and school facility information into a single, online platform.  Physical assessments and behavioral assessments along with the ability to report and monitor incidents on or near campus are hallmarks of Haystax for School Safety.  Know your threats sooner, respond faster, and effectively coordinate actions for all stakeholders.

Image module

Haystax for Public Safety

Law enforcement professionals are called upon daily to perform a broad range of tasks—from routine patrols, intelligence gathering and investigations to major crime and incident responses. Their challenge is to ensure public safety despite incomplete intelligence, limited cross-jurisdictional information sharing, and tight budgets. Haystax helps law enforcement agencies prepare for and respond to any crisis with a dynamic picture of emerging threats, rapid  intelligence-collection and incident-reporting tools, and a seamlessly integrated user environment that  ensures maximum collaboration and analytically sound command decisions for rapid response.

Image module

Haystax for Enterprise Security

Haystax has developed a suite of applications designed specifically to help corporate security decision-makers and analysts navigate this challenging environment. Haystax alerts corporate leaders to their most likely threats and natural hazards, provides critical security and operational information about each physical facility, regardless of its size or geographic location, and allows risk managers to identify and mitigate their biggest vulnerabilities. Moreover, the Haystax platform enables security teams to manage incidents and major events—from the ops center or out in the field.

Equipped with these insights, CSOs can better anticipate their risks, communicate with leadership and limit their company’s exposure to financial, legal and reputational liabilities.

Prevnew york cityThe View from a DHS OpEx08 July 2019NextHaystax Product Update: Security Enhancements13 August 2019

Most UBA Doesn’t Actually Focus on the User

July 11, 2019
Insider Threat

For more than a year now, industry analysts have been warning that user behavior analytics (UBA) would become fragmented as a market segment and could eventually recede into irrelevance.

In a new Haystax Insider Threat Report presenting the results of an industry survey conducted by our partner Cybersecurity Insiders, we see similar signs. For example, while 84% of companies surveyed “monitor user behavior in one way or another,” only 29% said they used UBA to detect insider threats. And those that did, according to the survey, mostly relied on “server logs to track user behavior (45%), followed by dedicated user activity monitoring solutions (33%), and monitoring features natively provided by the business apps (30%).”

It’s increasingly clear that the term UBA has come to mean something quite narrow: analysis of user behavior on networks and other systems, and the application of advanced analytics to detect anomalies and malicious behaviors in those systems.

The problem with this approach is that it actually doesn’t discover anything truly useful or actionable about the insider threat — such as intent or possible contributing stressors — but rather focuses almost exclusively on the individual’s device and network activity. No wonder the term ‘alert overload’ has become so prevalent.

At Haystax we take an altogether different approach to analyzing workplace risk, one that is person-centric rather than device- or network-centric. The ‘whole-person’ Bayesian model embedded in our Haystax Analytics Platform contains hundreds of nodes reflecting diverse experts’ judgments as to the most likely indicators of trustworthiness, or its absence.

The model was developed to detect individuals who show an inclination to commit or abet a variety of malicious insider acts, including: leaving a firm or agency with stolen files or selling the information illegally; committing fraud; sabotaging an organization’s reputation, IT systems or facilities; and committing acts of workplace violence or self-harm. It also can identify indicators of willful negligence (rule flouting, careless attitudes to security, etc.) and unwitting or accidental behavior (human error, fatigue, substance abuse, etc.) that could jeopardize an organization’s security.

Just as important as the model is the diversity of the information our customers apply as evidence to the model, allowing it to ‘reason’ and continuously update its ‘beliefs’ about a person’s trustworthiness. Our data connectors ingest information from a broad and diverse array of sources, and include financial, professional, legal and personal data originating from an organization’s own internal sources and from publicly available or third-party sources. Such data can include travel and expense records, access badge logs, financial and legal records, performance reviews and much more.

And, yes, the Haystax platform analyzes network and device data, too — but only uses the resulting machine-learned anomaly signals as but one of many indications of insider risk, so that anaysts are not overwhelmed with false-positive alerts. In the real world, there are plenty of legitimate reasons a person may be working at odd hours, printing large files or downloading sensitive data onto a thumb drive.

Current technologies behind user behavior analytics have not lived up to their early promise, and it’s unfortunate the term has come to be associated with its lowest common denominator.

By contrast, a person-centric approach that predictively analyzes real human behaviors and attitudes and stressors, leveraging previously neglected data sources, is the only way to detect your highest-priority insiders before they do harm. After all, you can’t investigate or fire a device.

#   #   #

Note: Learn more about the latest insider threat challenges and industry best practices by reading the full Haystax Insider Threat Report-2019, downloadable from our Resources page.

Related posts