Foundational Controls for UEBA

Several NIST 800-53 control families are crucial for establishing the data streams and policies necessary for effective UEBA.  Additionally, privileged accounts – those with elevated permissions – are prime targets due to their ability to access sensitive data and critical systems.  One of the primary event families for UEBA is monitoring these privileged accounts.

• Audit and Accountability (AU): This family is perhaps the most important for UEBA. Controls in this family require organizations to define, generate, protect, and retain audit logs of system activity. UEBA tools ingest this data – such as login attempts, file access, and application usage – to build a baseline of normal behavior for users and entities. Without these detailed and tamper-proof logs, UEBA would be impossible. The AU-2 (Event Logging) and AU-6 (Audit Review, Analysis, and Reporting) controls directly support the core functions of a UEBA solution.
• Identification and Authentication (IA): UEBA is all about understanding who is doing what. The IA control family ensures that users and entities are uniquely identified and properly authenticated before they can access resources. This provides the crucial “who” component for UEBA, allowing the system to link specific actions to a specific user or device. For example, IA-2 (Identification and Authentication) and IA-5 (Authenticator Management) ensure that user identities are strong and trustworthy, which is essential for accurate behavior analysis.
• Access Control (AC): This family of controls limits access to systems and information based on the principle of least privilege. AC-2 (Account Management) and AC-6 (Least Privilege) are particularly relevant. When an employee’s access is limited to only what they need to do their job, any attempt to access unauthorized resources becomes an immediate flag for the UEBA system. This makes it easier to spot malicious or compromised accounts.

Operational Controls for UEBA

Beyond the foundational data and policy controls, other NIST 800-53 families help operationalize and manage the security insights that UEBA provides.

• Incident Response (IR): A UEBA solution is designed to detect anomalous behavior that could indicate a security incident. The IR control family provides the framework for what happens next. Controls like IR-4 (Incident Handling) and IR-5 (Incident Monitoring) ensure that once an alert is triggered by the UEBA tool, the organization has a predefined process to investigate, contain, and recover from the incident.
• Awareness and Training (AT): This family focuses on the human element of security. Controls like AT-2 (Security Awareness Training) and AT-3 (Role-Based Training) can help reduce the very insider threats that UEBA is designed to detect. By training users on what constitutes appropriate behavior and what to be vigilant about, organizations can create a security-conscious culture that complements the technical monitoring provided by UEBA.
• Continuous Monitoring (CA-7): The NIST Risk Management Framework (RMF), supported by the 800-53 controls, emphasizes continuous monitoring. CA-7 (Continuous Monitoring) requires organizations to constantly assess and track the security posture of their systems. A UEBA tool is a perfect example of a technology that enables this control, providing real-time analysis and alerting to ensure security controls remain effective.