Consul InSight Solves the Critical Requirement of Monitoring the Privileged User; Consul InSight Privileged User Monitoring and Audit Solution Flags Behavior that Violates Policy; Delivers ''Must Have'' Audit Reports.

HERNDON, Va. -- Consul risk management, the authority in security audit and compliance, today unveiled its Consul InSight(TM) Privileged User Monitoring and Audit solution (InSight PUMA). InSight PUMA combines the InSight(TM) Security Manager technology with Consul's 20 years of audit reporting experience to offer organizations a solution to monitor, report and investigate the activities of privileged users. The solution enables organizations to demonstrate to regulators and auditors that they have proper controls in place over privileged user activities and are effectively managing security risks.

Why is Privileged User Monitoring a Critical Part of Information Systems Assurance?

Recent studies confirm that unauthorized activities by privileged users, such as administrators who have unrestricted access across applications and platforms, are the main cause of insider security breaches. According to the USSS/CERT Insider Threat Survey 2005, 86 percent of all "insider attacks" can be attributed to the privileged user. Accordingly, standards and regulations, such as the Statement on Auditing Standards No. 70 (SAS 70), the Payment Card Industry Data Security Standard (PCI DSS), Sarbanes-Oxley (SOX), Gramm-Leach Bliley (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA), state that the activities of privileged users are of concern. Left unchecked, privileged user activities can violate segregation of duties and lead to incidents of identity theft. Regulators and auditors have a zero-tolerance policy for this risk.

AEGON Canada Is a Step Ahead on Privileged User Monitoring

In order to pass an upcoming audit against SOX requirements, AEGON Canada needed to gain better control of its systems and logs, ensure the integrity of data, and monitor that the activities of employees, specifically privileged users, complied with policy. "'Trust but verify' is the motto," said Brian McPhedran assistant vice president, IT Risk Management, AEGON Canada. "Using Consul's InSight Security Manager, AEGON can quickly and easily determine if user activities comply with acceptable use policy of information assets. The reports from InSight do a tremendous job at interpreting the data at a system level. Auditors know that we are aware if staff violate policy by accident or intentionally."

"The fundamental building block for secure business practices is the trusted authentication of people and processes participating in online business transactions," said Eric Ogren, security analyst at Enterprise Strategy Group. "Monitoring privileged user activity protects the enterprise against unauthorized configuration changes that lead to operations which may bypass deployed security mechanisms. Consul's Privileged User Monitoring and Audit solution is a welcome focus that promises to allow security professionals to educate internal users and better manage corporate security."

Features of the Consul InSight Privileged User Monitoring and Audit Solution

Consul InSight Security Manager is the foundation of the InSight PUMA solution. In addition, an organization proceeds through a five-step implementation process resulting in "must have" audit reports to assure that privileged user monitoring requirements are being met. Combined with on-site training and customization of audit settings and policy definitions, Consul offers a complete bundle of services. InSight PUMA offers:

--Platform independent monitoring: InSight monitors across more than 80 applications, databases, operating systems and devices, which enables privileged user monitoring across the enterprise.

--User-oriented normalization: InSight comes with a built-in translation of every different log file it collects into an English, user-oriented language. This eliminates the need for deep technical and programming capabilities.

--Policy-based analysis: Acceptable use policy templates enable an organization to easily compare the activity of privileged users against company policy and hone in on non-compliant behavior.

--Built-in reports and alerts: InSight comes with dozens of reports and alerts that focus on the actual behavior of privileged users across the enterprise.

"Due to the rise in compliance and security awareness, audits have been more frequent. Yet, regulatory and audit pressures have made it clear that existing security technologies are missing the mark," said Kristin Gallina Lovejoy, CTO of Consul. "Efforts to date have focused on network-level, externally-oriented threats. This has left organizations woefully unprotected against the much greater risks posed by insiders and more importantly the authorized employees, customers, partners and outsourcers. Consul's unique approach enables organizations to monitor the behavior of privileged users without hindering business productivity."

About Consul risk management, Inc.

Founded in 1986, Consul risk management is an authority in security audit and compliance. Consul provides policy-based user monitoring solutions to track, report on and investigate non-compliant behavior, such as unauthorized activity by administrators and other privileged users. The Consul InSight(TM) Suite automates the process of enterprise-wide log collection, privileged user monitoring, behavioral forensics and compliance reporting.

More than 350 customers around the world rely on Consul to accelerate their security audit and compliance efforts, including AEGON Canada, Blue Cross/Blue Shield, Fidelity Financial Services, Ford, Kroger, The New York Times, Office Depot, Philadelphia Stock Exchange, Wachovia and government agencies. Consul has offices in the United States and the Netherlands, and 25 partners worldwide, including BMC Software. For additional information about Consul and its products, services and partners please call +1 800.258.5077 or +31 15.251.3333 (Worldwide), or visit www.consul.com.

Consul InSight Security Manager, Consul InSight, Consul InSight Suite, Consul InSight Privileged User Monitoring and Audit solution are trademarks of Consul risk management, Inc.