With more than 5 million records stolen worldwide every day, according to the data breach statistics of BreachLevelIndex.com, and three times more incidents than four years ago, breach detection and incident response have become topics of prime importance.
The ability to prevent incidents from happening in the first place, and to effectively respond to incidents if they should happen, is critical to every organisation.
Can you detect a breach in action?
In most cases, detecting a breach happens very late in the process with an average of 280 days to detect and contain a breach, even with millions invested in security infrastructure and more than often, companies will only discover a breach when they have been notified by a third party or the attacker, which is usually weeks or even months after the initial infiltration.
As we know, the aim of an attacker is to gain a foothold in the target network immediately following initial compromise, regardless of how this is achieved and once this is done the attacker will start to explore the targeted network for vulnerabilities and determine where exactly an organisation stores information of interest.
So, why do organisations discover a breach too late:
With all this in mind, we need to be thinking differently and take a SMART approach, that provides early detection of any suspicious activities across all environments, followed by only one relevant alert when it matters, significantly reducing the time of unauthorised access on your infrastructure.
Just as you would add alarms to your property, this SMART approach will give you peace of mind, knowing that you have a high fidelity breach detection for various environments including local network, data centre and cloud.
Our solution is a smart, efficacious, practical Managed Breach Service; developed to reveal the presence of malicious insiders with a significantly low dwell time.
How It Works:
Our Breach Detection devices are deployed throughout your environment either as a small form factor appliance, virtual or cloud-based detection devices. Once installed, the detectors are tuned and configured to mimic one of dozens of computing devices.
The only network access our Breach Detection device requires, is to a DNS server that is capable of external queries and is much less work than configuring border firewall rules for each device.
Attackers prowling a target network look for juicy content, browse Active Directory for file servers and explore file shares looking for documents, trying default passwords against network devices and web services, and scan for open services across the network.
When the attacker encounters a Breach Detection device, the services on offer are designed to solicit further investigation, at which point they have betrayed themselves, and you are notified of the incident with a detailed alert immediately reducing the dwell time.
Our Managed Breach Detection Service achieves the purpose of identifying intruders and reducing detection time.
The full service:
Together, we will evaluate your business requirements, defining constructively where exactly our devices should be located on your network and what type of services and assets they should mimic. Once completed, we install and configure the devices to filter any unwanted alerts, such as from internal solutions scanning the network. If and when an event occurs, ONE detailed alert is sent.
If you do not receive an alert, great news! However, we will send you regular detailed summaries, highlighting the status of the service, so that you are reassured they are active and watching… smart right?
"Any breach of security or loss of integrity that has a significant impact on a trust service provided or on the personal data maintained therein is critical to GDPR so businesses need to ensure that they have the systems, procedures and policies in place to be able to detect, contain and report when a breach occurs"