Detecting Hotspots and Cellular Devices with ADAM

Unknown hotspots pose a security risk because they allow employees or workers to bypass corporate network firewalls and security measures to access the internet or exfiltrate data. In this webinar, Bastille’s Technical Director, Peter Vescera, provides an overview of the Bastille system’s capability to detect and investigate these unknown hotspots generated by mobile devices.

What You’ll Learn

See step by step how ADAM (Bastille’s Advanced Detection Analytics Module) facilitates the monitoring and investigation of these threats:

1. Alerting: The system alerts administrators to an unknown hotspot, marking it as a high-level finding. The interface provides details such as the device’s MAC address and the broadcasted SSID (e.g., “Pixel 3”).
2. Location and RF Analysis: Administrators can view the hotspot’s location on a map and examine RF details like signal strength (RSSI) and transmitter IDs to help identify the device.
3. Client Identification: The system can detect when clients connect to these hotspots. It distinguishes between devices, identifying authorized employee devices by their data volume and authorization status.
4. Behavioral Investigation: By analyzing client logs, administrators can confirm network changes, such as a device switching from the corporate SSID to an unknown hotspot, which provides evidence of policy violations.
5. DVR and Historical Data: The system allows administrators to pivot to the Digital Video Recorder (DVR) to filter data for a specific device. The device dashboard then provides historical context, such as when the device first appeared on the network and its usage patterns over time.

Featured Speaker