GSN Aug/Sept Digital Edition

Cybersecurity and ConvergenceCyber threat probe, enhanced network situationalawareness added to Lumeta IPsonarSOMERSET, NJ – August 3, 2015– Lumeta Corporation, the leaderin network situational awareness,today announced the release of itsCyber Threat Probe for Lumeta IPsonar.The Cyber Threat Probe allowsclients to determine if knownthreat or malware IP address spaceon the Internet can be reached fromwithin their enterprise network, andalso if any of their internal networkinfrastructure is participating inmalicious activity, such as a zombiebotnet.Organizations are at constant riskof infiltration by known bad actorson the Internet or the Dark Web.Certain malware programs cancompromise software on a computer,turning that device into a zombieparticipant in a botnet. This zombiemachine, running quietly in thebackground, provides cyber attackersfull access to everything on thecomputer – and the ability to spreadspam, viruses and spyware acrossthe enterprise network or participatein distributed denial of serviceattacks on other unsuspecting organizations.It is also very common to find thatsecurity defenses are not uniformacross an enterprise network. Whilethere are many egress points thatdo not let traffic out to known malwareCommand and Control (C2)servers or third-generation onionrouter (TOR) exit nodes, it is alsotrue that Firewalls/Next-GenerationFirewalls/Intrusion PreventionSystems/Data Loss Prevention solutionsare not effective at limiting,or blocking entirely, outbound sessionsover risky protocols.Lumeta’s Cyber Threat Probe isdesigned to help organizations stemzombie infections and keep otherthreats and bad actors in check.With the Probe, threat intelligenceis made actionable by utilizing existingcapabilities of IPsonar 6.1 tocorrelate a comprehensive indexof an enterprise’s IP address spaceagainst known threats. As soon asnew threat intelligence becomesavailable, IPsonar will report againstthe new threats and send out notifications.The Cyber Threat Probeincludes the ability for user-definedviews to highlight findings and easeremediation.IT professionals can use the CyberThreat Probe for the following usecases: Zombie Hunting (Identificationof Botnet/C2 Infrastructure30Internally) – Determine whetheror not any trusted enterprise assetsare malware infected infrastructure(participating in command andcontrol botnet) or part of blacklists/Dropnets/Shadowserver/attackerlists.The Cyber Threat Probe correlatesIPsonar’s full index of the enterpriseIP address space against known badIP addresses to find enterprise assetsthat are blacklisted (listed in threatintelligence as malware/botnet machines).It raises a flag regarding anypotentially compromised machines.Identification of Internal TORRelays/Bridges – Determine if anytrusted/enterprise assets are, orwere, acting as TOR relays/ bridgespotentially for nefarious purposes.The Cyber Threat Probe correlatesIPsonar’s full index of the enterpriseIP address space against TOR relayIP addresses to find enterprise assetsthat are listed as an active (or historical)TOR relay. It flags devices thatare behaving as relays/bridges. Validation of No Access toKnown Malware C2 Servers – Determinewhether or not active securitycontrols prevent malware callbackand data exfiltration to knownbotnet/C2 networks and servers.