The GSN 2015 Digital Yearbook of Awards

analysts automatically at the suspicious modules and
attack vectors identified such as: floating code, hidden/
temp/program data folder write to executable, scripts
run (PSexec, whoami, etc.) which equips the analyst
with tools and techniques used to not only identify the
how but the who as well. All IIOCs are executed serverside
as data is processed, reducing no overhead on the
agent and client performance.
• Detection and Visibility through Layered Approach.
While ECAT performs live memory analysis and in-depth
inspection of host behavior, it is also leveraging other
ways of enriching data for analysis by using OPSWAT,
Yara, module reputation models, and multiple threat
intelligence data feeds including RSA Research and
community-based intel via STIX, enabling analysts to
quickly come to a resolution and take response action.
• Detect, Investigate and Response. While threats will
find their way into the organization, being able to trigger
a response action to shorten dwell time is a key.
ECAT is able to block and quarantine suspicious modules
for endpoints within a corporate network as well as
endpoints off network connected to the Internet.
• Machine Learning Risk Score system. The Risk Score
system collects and analyzes vast amounts of data on
the endpoint and network data transferred in/out and
compiles a module and machine risk score based on a
statistical machine-learning, adaptive model. ECAT’s analysts
leverage the risk score as the basis for prioritized
investigation, working on the most risky endpoints such
as: module behavior, machine status, threat intelligence,
business context, etc. Significant contributors to ECATs
Risk Scoring system are RSA’s data-science team and Incident
Responders providing contact feedback and new
findings identified.
• Enterprise Scalability. ECAT protects 50,000 agents
with a single ECAT server.
Link to Web Page of Nominated Organization:
––––––––––––––––––––––––––––––––––––––––
http://www.emc.com/domains/rsa/index.htm
Link to additional information on product,
service or program, with brief description:
––––––––––––––––––––––––––––––––––––––––
RSA ECAT Home Page:
https://www.emc.com/security/rsa-ecat.htm
Name and organization of nominating
contact for this entry, including name, title,
organization:
––––––––––––––––––––––––––––––––––––––––
Bryan Grillo, Vice President
CHEN PR
Nominating contact’s office telephone and cell
phone:
––––––––––––––––––––––––––––––––––––––––
office: (781) 466-8282
cell: (617) 947-0547
Nominating contact’s email address:
––––––––––––––––––––––––––––––––––––––––
bgrillo@chenpr.com
73