Threat Detection
A well-designed deception system is designed to fit non-disruptively into an organization’s existing security ecosystem. Deception and decoy solutions provide an additional line of defense for networks, data centers, cloud and SCADA environments to address the situations where attackers have bypassed prevention security systems and real-time notification of inside the network threats is required.
Security Infrastructure Solutions
Today’s cyber attacks come in a variety of threat vectors, which can include attacks that start with reconnaissance, stolen credentials, phishing or ransomware attacks. Attackers are in general either scanning a network to find hosts with services or applications to compromise or seeking to exfiltrate employee credentials or data. Either way, attackers and their automation tools rely on the responses they receive throughout the attack process they undertake to achieve success in their attacks. Real-time detection bundled with attack forensic analysis play a critical role changing the playing field against attackers. The hunters now become the hunted, putting the power of control back into an organization’s hands.
Deception Servers and Deception Lures
- Deception servers and deception lures are based on creating attractive bait and a matrix of deception servers designed to lure attackers into engaging. Comprehensive deception solutions include endpoint, server, and application level deceptions. Additionally, a deception platform will include the ability to provide attacker identification and forensics, which can be used to understand an attackers methodology, intent, and to defend against the cyber attack.
- Deception techniques are not necessarily new to security. However, significant technology advances and new approaches to deception are delivering additional capabilities, better scalability, and improved manageability over legacy approaches such as decoydocs.
Attacks That Begin With Reconnaissance
Attacks begin with a scan of the network from the infected endpoint to locate the asset and services an attacker wants to target.
- The Attivo solutions engage attackers by hosting network services across multiple virtual machines, IP services, and subnets luring attackers into revealing themselves as soon as they start to look for your high-value assets.
Attacks That Begin With Stolen Credentials
Attacker exploits the infected endpoint to extract credentials and location of the assets that it wants to target.
- The Attivo ThreatStrike Endpoint Solution provides a customizable and nonintrusive technology that lures such targeted attacks to its solution to detect infected endpoints, servers, and VMs.
Pre-Emptive Spear Phishing Management
Phishing scams are designed to take advantage of software and security weaknesses and a general lack of victim awareness and education to succeed. Masquerading as a familiar and reliable source, phishing scammers convince victims that their messages are legitimate and deceive them into providing confidential and financial information.
- To mitigate the risks posed by spear phishing, organizations can leverage the Attivo BOTsink® solution as a complement to their existing security technologies to detect threats that are inside their network and to identify the intent and maliciousness of a phishing campaign.
Insider Threat Visibility and Detection
Privilege escalation, abuse of privileged accounts and data exfiltration represent serious issues associated with insider security compromises. The Attivo Deception and Response Platform provides the visibility and detection for insiders, suppliers, and trusted 3rd party organizations that inherently bypass most security controls.
- Deception decoys lay traps to detect reconnaissance
- Deception credentials misdirect privileged account escalation
- ThreatPath shows exposed credentials and misconfigurations
Man-in-the-Middle
Stealing logins and passwords on the endpoint is not the only way attackers can compromise credentials. They can launch Man-in-the-middle attacks on the network to capture credentials in transit. Detecting MITM attackers can be challenging since they operate in the subnets and generally beyond the scope of traditional network security applications.
- Automatic or manual detection of MitM attack methods looking to steal credentials and data
- Capture in transit credential theft
Active Directory
Integrated deception into the production AD environment gives organizations a line of defense within their AD infrastructure while increasing the authenticity of deception objects at the network and endpoint.
- Coverage for a broad range of directory-based identity-related services, including: Domain Services, lightweight Directory Services, Certificate, Federation Services – single sign on, Rights Management Services
- Integration for verifying deception credential authenticity
Defense in Depth for Amazon Web Services
Amazon Web Services (AWS) has seen tremendous adoption of its public cloud offerings. Although AWS offers a wide range of security controls, Amazon makes it clear that public clouds entail a shared security model. The ThreatDefend Solution provides an adaptive defense with:
- Scalable, signatureless detection of advanced threats and targeted attacks
- Lateral movement threat detection designed for cloud data centers with large volumes of data.
Scalable Threat Detection for Azure Cloud
Azure cloud adoption is growing at unprecendent rates, driven by the need for on-demand scalable infrastructure. However, security controls have not been able to keep up and provide accurate and early detection of in-network threats. The ThreatDefend solution for Azure addresses this with:
- Scalable, signatureless detection of advanced threats and targeted attacks
- Lateral movement threat detection designed for cloud data centers with large volumes of data
Distributed Deception Platforms for Automated Incident Handling
ThreatOps™ accelerates incident handling by automatically correlating attack information within one dashboard to score and create playbooks.
- Incident scoring and playbooks for repeatable processes
- Automatic quarantine and attack blocking with 3rd party integrations
- Threat hunting through Attivo and NAC integration