original review here<\/a>.<\/p>\nQUICK READ<\/h2>\n
STRENGTHS:<\/span>\u00a0Solid functionality and ease of deployment.<\/p>\nWEAKNESSES:<\/span>\u00a0We wish that there was a way to accomplish the same functionality without being an inline appliance.<\/p>\nVERDICT:<\/span>\u00a0If you are using remote terminal services of any kind in a Microsoft network \u2013 and most businesses are \u2013 you should take a close look at this (or its larger, beefier, siblings).<\/p>\nSUMMARY<\/h3>\n
In our threat analysis lab \u2013 the \u201cdirty\u201d part of the SC Lab \u2013 we watch probes and attacks against our honeynet and we find that scans\/probes\/attacks are most prevalent against SSH, Telnet, FTP and RDP. However, we are concerned with any attack or probe against MS terminal services and there are not a lot of tools available to monitor that, and then collect evidence and perform analytics. RecordTS is exactly that. The simplest description is that it is a remote session recorder. The single server edition sits on a server running Terminal Services. It watches what users are doing through the server and makes a forensically sound record complete with audit trail. This not only shows connections \u2013 source and destination \u2013 as one would expect, it also logs the session content.<\/p>\n
While this is useful for watching behavior of users, it is more useful for watching the behavior of accounts. It long has been a maxim of data security that the account is more important than the user. That is because the behavior of the account can lead to understanding what the owner is doing or, more important perhaps, what an intruder who has compromised the account is doing. So we care about the account first and the owner second. This tool lets us gather the evidence that we need. With RecordTS, everything is stored in a backend SQL database (PostgreSQL).<\/p>\n
Architecturally, the server sits between the remote clients and the terminal server. It has a web-based dashboard\/console and the recorder that acts as a man-in-the-middle between users and the terminal server. There also is the SQL database for collecting and preserving evidence. The server gets its licensing information from TSFactory, the developer. Setup is straightforward and the hardware requirements are not onerous.<\/p>\n
One point, though: Lots of storage is a good thing. The database can grow pretty fast on a large system. But, remember that this is the single server edition. If you need a lot more power and, most important, distribution, you\u2019ll need the enterprise grade system. Even so, don\u2019t skimp on database storage. Also, make sure that your RecordTS server is in a physically secure area and that you restrict both logical and physical access. Remember, it contains evidence. The server regularly verifies its license with TSFactory so an internet connection is necessary. Take care in how you configure your firewall.<\/p>\n
We liked the replay capabilities of the product. If you catch a questionable session, you can play back a recording of it using the RecordTS player or you can convert it to AVI or SWF for distribution and preservation as evidence.<\/p>\n
Installation is very straightforward. Just make sure that there is constant access to the internet. If it cannot verify its license, everything stops. The good news is that you can set up buffering so that if the database is lost for a short period of time, you won\u2019t lose data. Also, the device sits inline between the terminal services server and the users. So, if the product becomes disabled, users lose connectivity. We see this as a problem, but it is unavoidable. If you are to decode the data stream as a man-in-the-middle, you must be in the middle. That means that care must be taken to ensure that the system either stays on line or is in a failover configuration with a standby server.<\/p>\n
This is a very interesting tool and, though it does just one thing \u2013 monitor and record remote terminal services sessions \u2013 it does that quite well. Pricing is reasonable and the documentation is very good. There is basic support included at no additional cost. We liked the website and its support portal. For example, when you go to support for your product you get a screen that says: \u201cFirst things first: READ THE MANUAL.\u201d It then conveniently provides access directly to the installation manual. There also is a support FAQ, all very nicely laid out.<\/p>\n","protected":false},"excerpt":{"rendered":"
TSFactory\u00a0received a 5 star review in SC Magazine, the leading source of specialist information and intelligence for those working in IT security. The review highlighted the solid functionality and ease of deployment. The review stated \u201cif you are using remote terminal services of any kind in a Microsoft network \u2013 and most businesses are \u2013 […]<\/p>\n","protected":false},"author":2,"featured_media":184,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-113","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-media"],"yoast_head":"\n
RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community\" \/>\n<meta property=\"og:description\" content=\"TSFactory\u00a0received a 5 star review in SC Magazine, the leading source of specialist information and intelligence for those working in IT security. The review highlighted the solid functionality and ease of deployment. The review stated \u201cif you are using remote terminal services of any kind in a Microsoft network \u2013 and most businesses are \u2013 […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/\" \/>\n<meta property=\"og:site_name\" content=\"Community\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TSFactoryLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2019-10-26T12:36:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-06-26T12:54:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Chelsie Wyatt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@TSFactoryLLC\" \/>\n<meta name=\"twitter:site\" content=\"@TSFactoryLLC\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Chelsie Wyatt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/\",\"name\":\"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community\",\"isPartOf\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg\",\"datePublished\":\"2019-10-26T12:36:43+00:00\",\"dateModified\":\"2020-06-26T12:54:44+00:00\",\"author\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg\",\"contentUrl\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.tsfactory.com\/forums\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#website\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/\",\"name\":\"Community\",\"description\":\"TSFactory\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.tsfactory.com\/forums\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f\",\"name\":\"Chelsie Wyatt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g\",\"caption\":\"Chelsie Wyatt\"},\"url\":\"https:\/\/www.tsfactory.com\/forums\/blog\/author\/chelsie\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/","og_locale":"en_US","og_type":"article","og_title":"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community","og_description":"TSFactory\u00a0received a 5 star review in SC Magazine, the leading source of specialist information and intelligence for those working in IT security. The review highlighted the solid functionality and ease of deployment. The review stated \u201cif you are using remote terminal services of any kind in a Microsoft network \u2013 and most businesses are \u2013 […]","og_url":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/","og_site_name":"Community","article_publisher":"https:\/\/www.facebook.com\/TSFactoryLLC\/","article_published_time":"2019-10-26T12:36:43+00:00","article_modified_time":"2020-06-26T12:54:44+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg","type":"image\/jpeg"}],"author":"Chelsie Wyatt","twitter_card":"summary_large_image","twitter_creator":"@TSFactoryLLC","twitter_site":"@TSFactoryLLC","twitter_misc":{"Written by":"Chelsie Wyatt","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/","url":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/","name":"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine - Community","isPartOf":{"@id":"https:\/\/www.tsfactory.com\/forums\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage"},"image":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage"},"thumbnailUrl":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg","datePublished":"2019-10-26T12:36:43+00:00","dateModified":"2020-06-26T12:54:44+00:00","author":{"@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f"},"breadcrumb":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#primaryimage","url":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg","contentUrl":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2019\/10\/acoustic-amplifier-artist-audio-114820.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/recordts-for-single-server-receives-5-star-review-from-sc-magazine\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.tsfactory.com\/forums\/"},{"@type":"ListItem","position":2,"name":"RecordTS for Single Server RECEIVES 5 STAR REVIEW FROM SC Magazine"}]},{"@type":"WebSite","@id":"https:\/\/www.tsfactory.com\/forums\/#website","url":"https:\/\/www.tsfactory.com\/forums\/","name":"Community","description":"TSFactory","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.tsfactory.com\/forums\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f","name":"Chelsie Wyatt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g","caption":"Chelsie Wyatt"},"url":"https:\/\/www.tsfactory.com\/forums\/blog\/author\/chelsie\/"}]}},"_links":{"self":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/comments?post=113"}],"version-history":[{"count":1,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/113\/revisions"}],"predecessor-version":[{"id":114,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/113\/revisions\/114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/media\/184"}],"wp:attachment":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/media?parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/categories?post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/tags?post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}