Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/25/2012
01:54 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

AccessData Releases Cyber Intelligence & Response Technology (CIRT) Version 2

CIRT integrates network and computer forensics, malware analysis, large-scale data, auditing, and remediation

LINDON, UT – July 25, 2012 – AccessData is announcing the release of Cyber Intelligence & Response Technology Version 2 (CIRT 2). CIRT is the first platform to integrate network and computer forensics, malware analysis, large-scale data auditing and remediation. The solution is an integration of four of AccessData’s proprietary technologies: the AD Enterprise network-enabled computer forensics solution, SilentRunner® network forensics product, the data auditing capabilities of AD eDiscovery and — new in version 2 — AccessData’s new Cerberus malware analysis technology.

Click here for more of Dark Reading's Black Hat articles.

Traditionally, organizations rely on a number of disparate tools for information assurance and incident response. There are often multiple teams each focusing on one small aspect of a much larger cyber security picture. For example, a forensics team, a network security team, information assurance or compliance auditing team each use different tools and may or may not collaborate on a routine basis. According to Jason Mical, Director of Network Forensics at AccessData, these gaps in technologies and processes make it difficult for an organization to quickly identify when a security breach or data leak has occurred. Since perimeter defense and alerting technologies can only detect what they’ve been told to look for, the ability to catch what tools, such as intrusion detection (IDS) and data loss prevention (DLP) systems, miss is absolutely vital. “Today, when an organization discovers it has been compromised, it’s often by accident, and usually long after widespread damage has occurred. CIRT is designed to provide 360-degree visibility into what is happening on your network to speed detection, root cause analysis and thorough remediation,” stated Mical.

By allowing users to correlate computer, network and malware data, as well as audit tens of thousands of machines, CIRT gives organizations the ability to identify and address all types of threats, including zero-day events, hacking, data spillage and advanced persistent threats. “In the age of Stuxnet and Flame, organizations need the visibility and response capabilities CIRT provides,” commented Mical. “It’s not just another platform that provides a mound of data to sift through. It delivers the threat intelligence you need and it remediates.” Using CIRT, organizations can continuously monitor network traffic, computers and removable media to detect threats and more quickly acquire actionable intelligence in the event of a cyber incident. In addition, with CIRT’s “check in” feature, CIRT users can monitor the laptops of traveling employees, even when they are not logged on to the organization’s network.

In a June 2010 article in the DoD blog, Armed with Science, head of US Cyber Command, General Alexander, stated “… we have been leaning forward and building an organization and a mission alignment that is more integrated, synchronized and effective…” In Mical’s view, integrated, synchronized and effective should extend beyond people and processes to include the technology deployed in facilitating incident response. In his words, “the incident response infrastructure is an organization’s last line of defense, so a few different teams, each juggling a bunch of tools, is not the most effective approach.”

One platform providing a single pane of glass through which users can see what is happening on the network and at the host level has been the vision of AccessData CEO, Tim Leehealey for the last decade. Key features of AccessData’s Cyber Intelligence & Response Technology include the following:

Correlate network and host analysis to quickly determine root cause and more effectively chase down data spillage. Identify and triage suspected malware using both static analysis and advanced disassembly analysis to determine behavior and intent without a sandbox or reliance on signature-based tools. Perform proactive and reactive enterprise audits to identify data spillage, such as personally identifiable information, payment card information or classified documents. Play back security incidents in real-time to gain a better understanding of an exploit or data spill. Build threat profiles and monitor to prevent incident recurrence. Continuously monitor the network and information assets, including removable devices, on or off the organization’s network. Perform batch remediation.

“By providing integrated analysis from multiple vantage points, as well as real-time collaboration among personnel and easy-to-read reporting for those at the top of the command chain, AccessData’s CIRT solution is the only product of its kind, engineered to better aid organizations in their efforts to stop the bleeding,” commented Leehealey.

About AccessData

AccessData Group has pioneered digital investigations and litigation support for 25 years. Its family of stand-alone and enterprise-class solutions, including FTK, SilentRunner, Summation and the CIRT security framework, enable digital investigations of any kind, including computer forensics, incident response, e-discovery, legal review and compliance auditing. More than 130,000 users in law enforcement, government agencies, corporations and law firms worldwide rely on AccessData software solutions and premier digital investigation and hosted review services. AccessData is also a leading provider of digital forensics and litigation support training and certification. www.accessdata.com

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26814
PUBLISHED: 2021-03-06
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service sc...
CVE-2021-27581
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
CVE-2021-28042
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
CVE-2021-28041
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
CVE-2021-3377
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.