Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/27/2016
10:00 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Attivo Networks Launches Attack Path Vulnerability Assessments for Continuous Threat Management at Black Hat

ThreatMatrix Detection Platform Expands, Providing Attack Path Prediction, Enhanced Deception Techniques and Support for Routed Networks

FREMONT, Calif., July 25, 2016— Attivo Networks®, the award-winning leader in deception for cyber security threat detection, today announced that the Attivo ThreatMatrix™ Deception and Response Platform has been enhanced to provide an organization’s visibility and assessment of vulnerable attack paths that a cyber attacker would take to reach critical assets. Attivo is empowering organizations with insight into how an attacker would target misconfigured systems or misused credentials and then automating the response actions to isolate these systems from causing additional infection, exfiltrating data or harming critical infrastructure.  Additionally, the company announced that its next generation software has enhanced its deception technology to misdirect and detect attackers seeking to begin their attack by targeting Microsoft Active Directory, which is a favored target for attackers seeking credentials for attack escalation. The new release will also include an expansion of the ThreatMatrix Platform to support routed networks, for micro-segmented datacenters and enterprises networked across multiple locations and branch offices.

The ThreatMatrix Deception and Response Platform provides real-time threat detection and attack forensic analysis for accelerated incident response and remediation. The platform is designed to provide early detection of cyberattacks from all threat vectors including zero-day, stolen credential, ransomware and phishing attacks that are renowned for bypassing traditional prevention systems. The platform is aligned to Gartner's Adaptive Security Architecture of Predict, Block/Prevent, Detect and Respond (Gartner, February 2016)* and is designed for early detection of threats, accelerated incident Response and strengthening of Prevention systems based on attack information gathered while deceiving and engaging attackers. The company’s announcement expands the ThreatMatrix Platform into the pillar of Prediction and enhances its Detection capabilities.

·         ThreatPath™: Provides an attack path vulnerability assessment based on likely attack paths that an attacker would have traversed through misconfigured systems or credential misuse. Visual illustrations of attacker paths based on penetration techniques provide insight into risks and clickable drill downs provide the details of weaknesses and IP addresses for systems needing to be isolated and/or fixed.

·         Active Directory Deception and Detection: Organizations running the Microsoft Windows Server platform are susceptible to attacks where attackers exploit and gain un-authorized access to Active Directory.  Attivo ThreatMatrix BOTsink® integrates deception into the organization’s Active Directory Infrastructure to deceive and identify attackers seeking to

 

gain escalation privileges.

·         Routed Network Support: ThreatMatrix BOTsink engagement servers can now engage with deceptive IP addresses and networks on routers over Layer 3 GRE tunnels, which is ideal for micro-segmented datacenters, enterprises networked across multiple locations and branch offices. The solution will also support sending Darknet IP traffic to the deception servers, which will dynamically engage attackers and deceive them into revealing themselves.

“Our customers are referring to the ThreatPath offering as an ideal and highly efficient solution for continuous end-point and server attack path vulnerability assessment.” said Tushar Kothari, CEO of Attivo Networks.  “Threatpath allows our customers to assess credential based vulnerabilities on demand and as frequently as they desire. This allows our customers to proactively address these vulnerabilities before an attacker can exploit them.”

In his April 7th report, “Addressing the Cyber Kill Chain”, Gartner Analyst Craig Lawson provides steps to augment existing prevention methods.  “Start to inventory how many steps of the CKC you currently cover for your most critical IT assets,” he states, “Know what’s on your network and prioritize patching that takes into account vulnerabilities that are seeing active exploitation in the wild.”

*Gartner, Top 10 Strategic Technology Trends for 2016: Adaptive Security Architecture, David W. Cearley, Avivah Litan, Brian Burke, and Mike J. Walker, 26 February 2016

 

About Attivo Networks

Attivo Networks® is an award-winning leader in deception technology for the real-time detection, analysis, and acceleration of incident response of cyber-attacks. The Attivo Threat Matrix™ Deception and Response Platform provides early detection of advanced, stolen credential, ransomware, and phishing attacks that are inside user networks, data centers, clouds, IoT and ICS-SCADA environments. By deceiving attackers into revealing themselves, comprehensive attack analysis is efficiently gathered, actionable alerts raised, and response actions automated with prevention system integrations.  Designed for continuous threat response, the platform provides vulnerability assessment of attack paths, that can be used to strengthen an organization’s overall security posture.  For more information, visit www.attivonetworks.com

 

 

Follow Attivo Networks: Twitter and Linked In

 

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25747
PUBLISHED: 2020-09-25
The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain access to RTSP and ONFIV services without authentication. Thus, the attacker can watch live streams from the camera, rotate the camera, change some settings (brightn...
CVE-2020-25748
PUBLISHED: 2020-09-25
A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can also modify responses from NTP and RTSP s...
CVE-2020-25749
PUBLISHED: 2020-09-25
The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet...
CVE-2020-24592
PUBLISHED: 2020-09-25
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization.
CVE-2020-24593
PUBLISHED: 2020-09-25
Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation.