User-ID: ip-user-mapping and group mapping

Find out what is ip-user-mapping, group mapping, and how to use it to strengthen your security posture! Kiwi dives into User-ID and shows how it enables you to leverage user information. See how these mappings help. Got questions? Get answers on LIVEcommunity!

Knowing who is using each of the applications on your network and who may have transmitted a threat or is transferring files, can strengthen security policies and reduce incident response times. User-ID enables you to leverage user information instead of vague IP addresses stored in a wide range of repositories.

Knowing who your users are instead of just their IP addresses enables:

Visibility – Improved visibility into application usage based on users gives you a more relevant picture of network activity. The power of User-ID becomes evident when you notice a strange or unfamiliar application on your network. Using either ACC or the log viewer, your security team can discern what the application is, who the user is, the bandwidth and session consumption, along with the source and destination of the application traffic, as well as any associated threats.
Policy control – Tying users to security policies improves safe enablement of applications traversing the network and ensures that only those users who have a business need for an application have access. For example, some applications, such as SaaS applications that enable access to Human Resources services (e.g., Workday or Service Now) must be available to any known user on your network. However, for more sensitive applications you can reduce your attack surface by ensuring that only users who need these applications can access them. While IT support personnel may legitimately need access to remote desktop applications, the majority of your users do not.
Logging, reporting, forensics – If a security incident occurs, forensics analysis and reporting based on user information rather than just IP addresses provides a more complete picture of the incident. For instance, you can use the pre-defined User/Group Activity to see a summary of the web activity of individual users or user groups, or the SaaS Application Usage report to see which users are transferring the most data over unsanctioned SaaS applications.

Knowing users' and groups' names is only one piece of the puzzle. The firewall also needs to know which IP addresses map to which users so that security rules can be enforced appropriately. Different methods are used to identify users and groups on your network as illustrated below. User Mapping

Defining policy rules based on group membership rather than on individual users simplifies administration because you don’t have to update the rules whenever new users are added to a group. When configuring group mapping, you can limit which groups will be available in policy rules. You can specify groups that already exist in your directory service or define custom groups based on LDAP filters. Defining custom groups can be quicker than creating new groups or changing existing ones on an LDAP server, and it doesn’t require an LDAP administrator to intervene. Group Mapping No need to worry! We have an excellent Getting Started Guide that can help you set up User-ID and ip-user-mapping in no time.