Analytics
1/15/2013
07:34 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

Sourcefire Extends Advanced Malware Protection With Incident Response Capabilities

Services enable customers to identify an event, evaluate the risk, and determine the most effective approach to remediate

Columbia, MD – January 14, 2013 -- Sourcefire, Inc. (Nasdaq: FIRE), a leader in intelligent cybersecurity solutions, today announced it has expanded its advanced malware protection offerings to include new Incident Response Professional Services that assist customers in addressing advanced malware challenges. The services enable customers to clearly identify an event, evaluate the risk and determine the most effective approach to remediate. Experienced in incident response techniques, methodology and the actions of malicious code, the Sourcefire Incident Response Team helps customers eliminate uncertainty and make educated decisions for better protection – before, during and after an attack.

“Given the inevitability of a security breach, large organizations must supplement Advanced Malware Detection/Prevention network and host-based controls with effective and efficient incident response policies, processes and metrics,” said Jon Oltsik, Senior Principal Analyst, Enterprise Strategy Group (ESG).1 “Many security solutions were designed for advanced malware detection and blocking alone, and lack the intelligence and integration necessary for incident detection and response. One notable exception of products and services comes from network security leader Sourcefire.”

The Sourcefire Incident Response team assists customers in diagnosing, identifying and remediating risks using Sourcefire technology. Sourcefire advanced malware protection for FirePOWER™ and FireAMP™ use security big data analytics and collective intelligence to deliver integrated, advanced malware protection from the network to end-devices. The Incident Response team helps customers leverage the intelligence these solutions provide, including forensic data, continuous file analysis, and visibility into file trajectory and behavior, to make more informed security and incident response decisions across the entire advanced malware lifecycle.

Using best practices for incident response and a structured approach to incident evaluation, the Sourcefire experts act as an extension of the customer’s team to identify risk and minimize it in the future. Services include incident investigation to determine the method(s) of attack employed by the attacker throughout the course of the incident; countermeasure development to detect and stop attacks; assistance in deploying countermeasures according to best practices; and validation of countermeasure effectiveness and recalibration as needed to ensure ongoing protection.

“Advanced malware protection is not just about having the right technologies in place but also the right response when the technologies identify an event,” said Jonathan Goldberger, vice president of professional services for Sourcefire. “Our incident response service helps our customers bridge the knowledge and experience gap so that they can take a more proactive stance to identifying, mitigating and eliminating risks using the intelligence from FireAMP and advanced malware protection for FirePOWER.”

Complimentary Webinar

Discover the 4 Dimensions of Incident Response during the complimentary webinar, “Malware War Stories.” Register for one of three sessions: http://www.sourcefire.com/malwarewarstories

About Sourcefire Professional Services

Sourcefire Professional Services combines a sophisticated and empirical approach to customer satisfaction with more than a decade of thought leadership in cybersecurity technologies. All offerings are based on best practices maintained by Sourcefire and derived from Information Security Standards (CISSP Domains, ISO 27000 series, etc.), compliance standards (PCI, HIPAA, SOX, FISMA, etc.) and our extensive experience deploying, architecting, tuning and securing environments globally.

About Sourcefire Sourcefire, Inc. (Nasdaq:FIRE), a world leader in intelligent cybersecurity solutions, is transforming the way global large- to mid-size organizations and government agencies manage and minimize network security risks. With solutions from a next-generation network security platform to advanced malware protection, Sourcefire provides customers with Agile Security® that is as dynamic as the real world it protects and the attackers against which it defends. Trusted for more than 10 years, Sourcefire has been consistently recognized for its innovation and industry leadership with numerous patents, world-class research, and award-winning technology. Today, the name Sourcefire has grown synonymous with innovation, security intelligence and agile end-to-end security protection. For more information about Sourcefire, please visit www.sourcefire.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.