Incident Response

In today’s threat environment, it is critical to respond to incidents quickly and definitively. The absence of data, or the use of metadata-only analysis tools, can lead to delayed or less-than definitive responses to serious security issues. The time is takes between knowing something happened and identifying what it was has real economic impacts to today’s enterprise. When responding to today’s threats, every second matters and having definitive data is essential.

Malware, Botnets, and APT

Zero-day malware, stealth botnets, and Advanced Persistent Threats have dominated the headlines in recent times. The trends are clear: threats are no longer motivated by fame or vandalism but now focus on economic benefit and even information warfare. Targeted attacks are a risk to the economic welfare of many organizations, and are generally engineered and operated by sophisticated and attackers. These types of attacks are by design difficult to detect using traditional network security tools. The definition of zero-day is that no signature exists on your IDS or AV systems to detect it. APT takes the “slow and low” tactic to evade traditional defenses.

Insider Threats and Acceptable Use

Many CISOs report that insider threats are the number one concern they have about the security of their corporate intellectual property and brand value. It only takes one disgruntled or financially motivated employee with their standard access to data to cause major damage – within seconds. Now, with the advent of social media for personal and corporate communications, the speed and simplicity of sharing data outside the corporate network has never been easier. Companies that have tried to limit the use of social media have found their employees leave to find employment at companies with “more flexible” acceptable use policies.

Data Breach

Data breach events are occurring at an alarming rate of more than one per day in 2011. The average cost of a data breach to an organization was $7.2 million in 2010 according to the Ponemon Institute’s annual report on the topic. Cleaning up after a breach is the most expensive process, and it is directly related to the type of information and the number of records exposed.