Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

Prior investments made for innetwork
threat detection have
been historically low, driven
by detection technologies that
generated false alarms or were
limited to only detecting known
attacks. Attivo brings forward a
different approach to detection,
which provides tremendous value
based on its ability to accurately
detect threats, raise only highfidelity
substantiated alerts, and
provide native integrations for
automated incident response.
Deception technology provides
organizations the ability to create
a proactive defense against the
adversary. This includes setting
decoy landmines lying in wait for
the attacker, proactive luring for
revealing in-network attackers,
and the ability to collect rich
adversary intelligence that can
be used to verify eradication of
threats, mitigation of returning
perpetrators, and fortifying
overall defenses. DecoyDocs
can also be insightful for
understanding what an attacker
is targeting and the geolocation
of opened documents.
Attivo commercial-grade
deception has removed prior
scalability and operational
management barriers that had
limited the adoption of earlier
deception technologies. The
company’s use of machine
self-learning automates the
preparation, deployment,
and ongoing maintenance of
the deception environment
and the solution’s flexible
architecture makes deploying
across datacenters, cloud, user
networks, remote locations, and
specialized networks quick and
easy. It is now so simple that
customers report that it takes
less than 5% of one FTE’s time
to manage the Attivo deception
platform.
It is notable that Gartner is
recommending deception
technology as a top 10 strategic
technology trend for 2018 and
views Attivo Networks as a market
leader with the most mature and
comprehensive portfolio.
Attivo ThreatDefend Deception
and Response Solution:
The ThreatDefend Platform
provides a powerful security
control for early threat detection
and for applying a proactive
defense that can be used
to change the asymmetry
of an attack. As the most
comprehensive and scalable
platform on the market, Attivo
dynamic traps, bait, and lures
provide threat deception for
today’s evolving attack surfaces
including networks, cloud,
data centers, remote offices,
and specialized environments
such as IoT, medical IoT, ICS-
SCADA, POS, infrastructure, and
telecommunications. By creating
attractive and believable decoys,
the solution turns the network
into a virtual “hall of mirrors,”
that disrupts an attacker’s reality
and imposes increased cost as
they are forced to decipher real
from fake. One small mistake
will reveal the attacker’s
presence and force them to start
over or abandon their efforts
altogether. The ThreatDefend
architectural approach also
removes the debate of whether
deception is best suited at the
endpoint or within the network
by providing both. Deployment
at the endpoint and at the
network level provides early and
accurate detection of attacks
from all threat vectors including
reconnaissance, credential theft,
Active Directory, and complex
man-in-the-middle attacks. The
company has also pioneered
machine self-learning which
automates the preparation,
deployment, and maintenance
of the deception environment.
Ease of management combined
with actionable high-fidelity
alerts make the ThreatDefend
solution simple for organizations
of all sizes to operate, without
the need for adding incremental
resources.
Cyber Defense Magazine - Annual Print Edition 2019 55