BMST Session Auditor: RDP/VNC/SSH record and play back

[song]

The BMST Session Auditor is a three part product consisting of the Sensor (an appliance) that is deployed like a bridge between the servers and clients, the Datacenter (an appliance) that stores all the session data captured from the Sensor, and the GUI Console which is a software that can be installed on Windows XP or above.

The Sensor works transparently, which means that there is no need to install agents on clients or servers and no need to do extra configuration on them. The Sensor watches the network sessions passing through it and do one of three possible actions on them: pass-and-record, pass through, or drop the session, according to the audit policy that configured using GUI Console.

The Sensor support fail-safe operation, wherein if the appliance lose power network traffic is allowed to continue to flow through the device unstopped.

The Datacenter includes up to 4TB RAID 5 storage and high performance Gigabit network interface, it can gather session data from multiple Sensors simultaneously. Inside the Datacenter there is a proprietary session database, which provides the GUI Console with the powerful and high performance session searching ability. The searching criteria can be session start/end time or interval, source/destination address, network protocol, destination ports, regualar-expression keywords or logical and /or combinations of the above.

The GUI Console is the control center of both Sensors and Datacenters. It also provides user interface for session browsing, monitering, inspecting, searching and replaying.

The breakthrough features of Session Auditor include its ability to audit encrypted network sessions such as of SSH and Windows Remote Desktop Protocol (RDP), and graphic play back of interactive sessions (including SSH, RDP, VNC, Telnet, Rlogin, etc).

Session Auditor supports audit of database query operation of Oracle, Sybase and Microsoft SQL Server.

Other features of Session Auditor include: VLAN trunk deployment support, appliance time synchronization, real-time session monitering, session data dumping, reporting, real-time events displaying, appliance graphic CPU/memory/network monitering, and serial port configuration menu of Sensor and Datacenter, etc.

Session Auditor can be used to audit internal Unix/Windows server maintenance operations, third party remotely support operations, security consultant’s operation, and for forensic analysis. In server-based computing environment (thin client using Microsoft terminal server), Session Auditor can also be used to audit the access to the critical applications such as ERP, CRM, etc.

The white paper can be downloaded at:
http://www.bmst.net/wp/bmst_sa_wp_en.pdf