Tabula Rosa Case Study For A Heathcare Company From Attivo Networks

 

 =======================================================

Attivo Networks Case Study For A Healthcare Solution

This healthcare company’s experience with attacks from inside their network continued to plague the CIO until they installed their BOTsink Solutions. The company believes that their BOTsink Solution has effectively become their last line of security defense to catch threats that penetrate or slip in the back door of their network.

                Attivo’s Honeynet technology traps the attacker before any damage can be done to their network

                Attacks can easily be trapped in a sinkhole for forensic study

                Security software can be configured to block the threat as revealed once it engages with their BOTsink Solution

                Provides an additional layer of security that easily scales within large complex networks

Results

The company has deployed the full suite of Attivo BOTsink solutions:

BOTSink 2500: appliance and virtual appliance form factors for support of up to 16 and 25 VLANs respectively

BOTsink 5000: appliance and virtual appliance form factors for support of up to 100 and 125 VLANs respectively

Information Relay Entrapment System (IRES) Endpoint Coverage: when an endpoint is compromised, the attacker is given IP addresses and login credentials that leads them directly to the BOTsink solution

By deploying the complete BOTsink Solution suite, the company is able to discover the attack at the earliest stage, denying the attacker the time needed to mount a successful data exfiltration.

Customer Benefits

When the company installed the Attivo BOTsink Solution, the key benefits they found included:

Most effective way to screen East-West data center traffic with minimal disruption to their data center operations: not installed in-line; no processor-intense calculation for packet inspection or data analysis on the wire

Eliminates false positives as it engages hacker attacks on internal network to derive alerts and forensics

Improves effectiveness of the security staff as they can focus on real threats instead of chasing false positives

IRES proven to be very effective with targeted attacks on BYOD devices that steal credentials to access the corporate. Using the IRES technology, the company drives the hacker into going after the BOTsink solution where its presence is immediately detected and mitigated.

The Role of the Attivo BOTsink^TM Solution

The Attivo BOTsink Solution can be used to validate the effectiveness of security defenses and accelerate the identification of BOTs and advanced persistent threats (APTs) inside your network. The Attivo BOTsink solution is a purpose-built, set-and-forget breach detection solution that complements your FireEye and Palo Alto Networks deployments by ensuring you have the visibility and defense capabilities you need to engage attackers as soon as they start to engage on your network looking for your high value assets and shut them down.

By using the Attivo BOTsink and IRES Solutions, any BOT or APT that uses scanning or targeted attacks will be caught. As a result, BOTsink can catch the source of the infection early in its lifecycle to prevent its propagation and capture full forensic information that can help minimize remediation efforts.

The Attivo BOTsink Solution can detect and engage both BOTs and APTs that begin their attack with reconnaissance or scanning to identify potential targets; and intelligent BOTs and APTs that initiate their attacks from hijacked endpoints and target specific resources, without the need for reconnaissance or scanning. Regardless of their methods, the BOTsink Solution will be able to identify an attacker as soon as they become active to reduce detection times, uncover infected systems on the network and prevent whatever comes in from ever getting out. Once engaged, the BOTsink Solution stops the attack from communicating and propagating; as soon as the attack runs its course and is catalogued, the environment is reset to completely destroy the BOT and APT.

Attivo’s Unique HoneyNet Solution

The Attivo BOTsink Solution is ideal for defending against BOTs and APTs brought into your network via a host of BYOD devices. With an Attivo BOTsink interleaved throughout your network, you will be able to:

                Reduces Attack Detection Time—providing accurate, actionable alerts that quickly and accurately identify infected clients, including sleeper and time-triggered agents, to enable remediation of the full extent of the attack before it can do any damage

                Capture Actionable Information—identifies the infected client, it prevents any ongoing communications outside the appliance to stop the attack’s propagation

                Destroy the APTs and BOTs—prevents whatever comes in from ever getting out—stops the attack and destroys the BOT and APT once data is collected

                        Guards your network 24x7x365—self-contained solution constantly monitors activity and rebuilds itself to ensure optimal performance.

**Important note** - contact our company for very powerful solutions Sinkhiles for Bots, IP management (IPv4 and IPv6), security, firewall and APT solutions:

www.tabularosa.net

In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” will be published soon follow by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:

 www.amazon.com/author/paulbabicki

 If you would like to listen to experts in all aspects of Netiquette and communication, try my radio show on BlogtalkRadio  Additionally, I provide content for an online newsletter via paper.li. I have also established Netiquette discussion groups with Linkedin and Yahoo.  I am also a member of the International Business Etiquette and Protocol Group and Minding Manners among others. Further, I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and have been a contributor to numerous blogs and publications. 

Lastly, I am the founder and president of Tabula Rosa Systems, a company that provides “best of breed” products for network, security and system management and services. Tabula Rosa has a new blog and Twitter site which offers great IT product information for virtually anyone.

==============================================