Data Security, Platform Security, Software Security

Vectra Unifies AI-driven Behavior-based Detection and Signature-based Detection in a Single Solution

Prnewswire | March 27, 2023 | Read time : 05:00 min

Vectra Unifies AI-driven Behavior-based Detection

Vectra AI, the leader in AI-driven hybrid cloud threat detection and response, today announced the introduction of Vectra Match. Vectra Match brings intrusion detection signature context to Vectra Network Detection and Response (NDR), enabling security teams to accelerate their evolution to AI-driven threat detection and response without sacrificing investments already made in signatures.

"As enterprises transform embracing digital identities, supply chains and ecosystems - GRC and SOC teams are forced to keep pace. Keeping pace with existing, evolving and emerging cyber threats requires visibility, context and control for both known and unknown threats. The challenge for many security organizations is doing so without adding complexity and cost," says Kevin Kennedy, SVP Products at Vectra.

With the addition of Vectra Match, Vectra NDR addresses core GRC and SOC use cases enabling more efficient and effective:

  • Correlation and validation of threat signals for accuracy.
  • Compliance for network-based CVE detection with compensating controls.
  • Threat hunting, investigation and incident response processes.

"CISOs and their SOC teams across Asia Pacific are working with a challenging lack of visibility across their hybrid cloud environments, as attackers continue to evolve. Vectra NDR now enables security teams to unify signatures for known threats and AI-driven behavior-based detection for unknown threats in a single solution," comments David Sajoto, Vice President Vectra Asia Pacific Japan.

According to Gartner®, "recent trends in the NDR market indicate many NDR offerings have expanded to capture new categories of events and to analyze additional traffic patterns. This includes new detection techniques: by adding support for more traditional signatures, performance monitoring, threat intelligence and sometimes malware detection engines. This move toward more multifunction network detection aligns well with the use case of network/security operations convergence, but also with midsize enterprises."1

"The attack surface cyber attackers have at their disposal continues to grow exponentially creating unknown threats on top of the tens of thousands of known vulnerabilities that exist. Attackers simply have exponentially more ways to infiltrate an organization and exfiltrate data -- and do so with far more frequency, velocity and impact. Keeping pace with attackers exploiting known vulnerabilities and unknown threats is an immense challenge for every Security, Risk and Compliance officer," says Ronald Heil, Global Risk Advisory Lead for Energy and Natural Resources and Partner at KPMG Netherlands. "Today, cyber-resilience and compliance requires complete visibility and context for both known and unknown attacker methods. Without it, disrupting and containing their impact becomes an exercise in brand reputation and customer trust damage control. Vectra Match capabilities allow us to combine both worlds, having the continued AI-based detection of real-time "movement", while also having the ability to check against specific Suricata indicators -- often required during incident response or proof of compliancy (e.g., Log4J). Consolidating AI-based and signature-based detection enables optimization, because in our case, less is more."

"When it comes to shadow IT, we know people with admin rights are 'building boxes off the grid.' Our SOC team cannot protect what we cannot see, thus making these unknown systems prime targets for attackers. No doubt, behavior-based AI-driven detections are great for catching attackers deploying new, evasive methods, but when it comes to attackers leveraging CVEs to compromise unknown, unpatched systems, we need signature-based detection. Combining signature-based detection with behavior-based detection gives our SOC team visibility for both the known-unknown and unknown-unknown threats. It's the best of both worlds," says Brett Fernicola, Sr. Director, Security Operations at Anywhere.re.

Vectra NDR with Vectra Match

Vectra NDR - a key component of the Vectra platform - provides end-to-end protection against hybrid and multicloud attacks. Deployed on-premises or in the cloud, the Vectra NDR console is a single source of truth (visibility) and first line of defense (control) for attacks traversing cloud and data center networks. By harnessing AI-driven Attack Signal Intelligence, Vectra NDR empowers GRC and SOC teams with:

  • AI-driven Detections that think like an attacker by going beyond signatures and anomalies to understand attacker behavior and zero in on attacker TTPs across the entire cyber kill chain post compromise, with 90% fewer blind spots and 3x more threats proactively identified.
  • AI-driven Triage that knows what is malicious by utilizing ML to analyze detection patterns unique to the customer's environment to score how meaningful each detection is, thus reducing 85% of alert noise - surfacing only relevant true positive events that require analyst attention.
  • AI-driven Prioritization that focuses on what is urgent by automatically correlating attacker TTPs across attack surfaces, evaluating each entity against globally observed attack profiles to create an attack urgency rating enabling analysts to focus on the most critical threats to the organization.

Vectra NDR empowers security and risk professionals with next-level intrusion detection. Armed with rich context on both known and unknown threats, GRC and SOC teams not only improve the effectiveness of their threat detection, but the efficiency on their threat hunting, investigation and incident response program and processes. Vectra NDR with Vectra Match is available for evaluation and purchase today. For additional information, please visit the following resources.

About Vectra

Vectra® is the leader in Security AI-driven hybrid cloud threat detection and response. Only Vectra optimizes AI to detect attacker methods - the TTPs at the heart of all attacks - rather than simplistically alerting on "different." The resulting high-fidelity threat signal and clear context enables cybersecurity teams to rapidly respond to threats and stop attacks from becoming breaches. The Vectra platform and services cover public cloud, SaaS applications, identity systems and network infrastructure - both on-premises and cloud-based. Organizations worldwide rely on the Vectra platform and services for resilience to ransomware, supply chain compromise, identity takeovers, and other cyberattacks impacting their organization.

Spotlight

The reality of email is that cybercriminals can use almost any brand or email domain to send spam, phishing emails, and malware installs, inflicting direct losses to customers and eroding the brand equity companies have spent years building up. The solution is DMARC, which allows companies to understand all the different mail st

Spotlight

The reality of email is that cybercriminals can use almost any brand or email domain to send spam, phishing emails, and malware installs, inflicting direct losses to customers and eroding the brand equity companies have spent years building up. The solution is DMARC, which allows companies to understand all the different mail st

Related News

Enterprise Security, Web Security Tools

Netskope Achieves AWS Security Competency Status for Infrastructure Protection

PR Newswire | August 28, 2023

Netskope, today announced that it has achieved Amazon Web Services (AWS) Security Competency status in the Infrastructure Protection category. As a widely recognized industry leader in secure access service edge (SASE), Security Service Edge (SSE), and modern connectivity and performance, Netskope works with AWS and other cloud providers to secure and optimize the most demanding cloud-first environments. Achieving the AWS Security Competency differentiates Netskope as an AWS Partner Network (APN) member that meets rigorous security specifications on AWS. In addition, Netskope was recently recognized as a "finalist" for the AWS US Rising Star Partner of the Year at this year's AWS New York Partner Summit. With the rapid migration of critical workloads to the cloud, the increase in the hybrid workforce, and today's complex cybersecurity landscape, the need for robust cloud security solutions is more critical than ever before. Netskope has helped thousands of customers, including more than 25 of the Fortune 100, improve their security posture. Netskope helps customers address AWS's shared responsibility model of cloud security for several important use cases: Provide secure remote access to private applications on AWS - Remote and hybrid workers need to access business-critical applications from anywhere. Netskope Private Access (NPA), Netskope's zero trust network access (ZTNA) solution, provides secure, granular access based on adaptive trust principles. This means that users can only access the applications and resources they need when they need them. NPA also improves security by replacing outdated VPN gateways and concentrators that expose their IP addresses to the public internet. Private resources are not visible on the public internet and are shielded from attackers. Discover shadow IT and block data exfiltration and threats - Netskope can act in real-time to block movement of sensitive data, threats, unauthorized users, and access to rogue accounts. Netskope Cloud Access Security Broker (CASB) Inline monitors traffic to and from AWS resources and applications to expose suspicious or malicious activity. Netskope's Zero Trust Engine decodes activities in real-time to place activity-level restrictions on users, groups, and organizational units across more than 270 AWS services. Netskope's Next Generation Secure Web Gateway (SWG) blocks malware, detects advanced threats, and controls cloud apps and services for users located anywhere, using any device. Discover sensitive data and malware in Amazon Simple Storage Service (Amazon S3) - Netskope CASB API scans Amazon S3 buckets to identify sensitive data and protect it from misuse. It also discovers malware and generates alerts to help prevent threats from spreading. Extensive integrations provide visibility and information sharing across cloud and hybrid environments - Netskope integrates with a variety of AWS services including AWS CloudTrail, AWS CloudTrail Lake, Amazon Security Lake, Amazon S3, and Amazon GuardDuty to share logs, alerts, events, and threat information. Netskope Cloud Exchange (CE) offers a wide variety of plug-ins and modules to facilitate exchange of information between cloud services, security tools, and data lakes, and automate remediation. CE can be deployed on Amazon Elastic Container Service (Amazon ECS) using AWS Fargate. Netskope also integrates with AWS Control Tower for customers needing automated deployment and consistent security policy across multi-account AWS customer environments. "We are thrilled to achieve the AWS Security Competency in the Infrastructure Protection category, as it highlights our ongoing commitment to help organizations provide secure access to applications and resources, protect data, and reduce risk in the cloud," said Andy Horwitz, Vice President, Business Development and Technology Alliances, Netskope. "This achievement demonstrates our commitment to AWS customers through our team's hard work and dedication to providing cutting-edge security solutions that address the evolving challenges of secure cloud adoption." AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the AWS Competency Program to help customers identify AWS Partners with deep industry experience and expertise. About Netskope Netskope, a global SASE leader, helps organizations apply zero trust principles and AI/ML innovations to protect data and defend against cyber threats. Fast and easy to use, the Netskope platform provides optimized access and real-time security for people, devices, and data anywhere they go. Netskope helps customers reduce risk, accelerate performance, and get unrivaled visibility into any cloud, web, and private application activity. Thousands of customers trust Netskope and its powerful NewEdge network to address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements. Learn how Netskope helps customers be ready for anything on their SASE journey, visit netskope.com.

Read More

Enterprise Security, Software Security, API Security

Salt Security API Protection Platform Wins "Best API Security Solution" in Prestigious 2023 SC Awards

PR Newswire | August 22, 2023

Salt Security, the leading API security company, today announced that the Salt Security API Protection Platform has won the "Best API Security Solution" category in this year's 2023 SC Awards. Now in its 26th year, the SC Awards recognizes outstanding solutions, organizations and people driving advancements in the practice of information security. Salt Security pioneered the API security market. Its proven and mature API security platform empowers organizations to easily and quickly detect the reconnaissance activity of bad actors and block them before they can successfully reach their objective. With its powerful cloud-scale big data and time-tested artificial intelligence (AI) algorithms, Salt delivers automated and continuous analysis and the adaptive intelligence required to identify and defend against today's increasing API attacks, including those outlined in the OWASP API Security Top 10 list. These protections enable organizations to prevent fraud, secure their own and their customers' data, and ultimately protect revenue. "APIs represent the critical communications link that transports the data powering all of today's digital innovation," said Roey Eliyahu, co-founder and CEO, Salt Security. "Because APIs carry such vast and valuable amounts of sensitive and personal data, they have become a huge attack target for cybercriminals. However, the nature of API attacks differs from traditional attacks. Salt was the first to recognize the need for a different security approach, and we are honored to have our approach validated with this SC Award for Best API Security Solution." According to the Salt Labs State of API Security Report, Q1 2023, 94% of survey respondents experienced security problems in production APIs in the past year, with 17% stating their organizations suffered a data breach as a result of security gaps in APIs. The Salt platform delivers the deepest insights into API threats and vulnerabilities to quickly detect and block attackers. By applying its ML and AI algorithms, Salt can capture and baseline all API traffic over days, weeks, and even months, providing real-time analysis and correlation across billions of API calls to protect organizations from API threats. "This year's SC Award winners reflected our industry in flux," said Tom Spring, SC Media's editorial director at CyberRisk Alliance. "Winners demonstrated uncanny market agility and brought innovative solutions to help their customers stay ahead of increasingly sophisticated adversaries and emerging threats." About Salt Security Salt Security protects the APIs that form the core of every modern application. Its patented API Protection Platform is the only API security solution that combines the power of cloud-scale big data and time-tested ML/AI to detect and prevent API attacks. By correlating activities across millions of APIs and users over time, Salt delivers deep context with real-time analysis and continuous insights for API discovery, attack prevention, and hardening APIs. Deployed quickly and seamlessly integrated within existing systems, the Salt platform gives customers immediate value and protection, so they can innovate with confidence and accelerate their digital transformation initiatives. For more information, visit: https://salt.security/

Read More

Cloud Security

Cisco Secure Application to Provide Business Risk Observability

Cisco | September 15, 2023

Cisco Secure Application, new to the Cisco Full-Stack Observability Platform, brings application and security teams together to secure cloud-native application development and deployment. The platform integrates Cisco's industry-leading security products' security intelligence with application performance data to provide business context with security findings. Cisco-exclusive business risk observability enables IT professionals to identify, assess, and prioritize risk and fix application security concerns based on potential business impact. Cisco, a worldwide technology leader that offers innovative software-defined networking, cloud, and security solutions, has unveiled the availability of the Cisco Secure Application, formerly known as Security Insights for Cloud Native Application Observability, on the Cisco Full-Stack Observability platform. This integration empowers organizations to seamlessly unite their application and security teams, facilitating the secure development and deployment of modern applications. The latest release of Cisco Secure Application extends its capabilities to securely manage both cloud-native and hybrid applications. In an effort to assist organizations in bolstering their cloud-native applications security, Cisco has introduced the new Cisco Secure Application offering, which is available on Cisco's recently introduced Full-Stack Observability platform. This solution equips customers with enhanced visibility and intelligent insights regarding business risk in various cloud environments. As a result, businesses gain the ability to more effectively prioritize and respond to security risks that could impact revenue and reputation in real time, leading to a reduction in overall organizational risk profiles. As organizations strive to provide smooth digital experiences, IT teams have faced growing demands to transition to modern, distributed applications. According to a recent study by Cisco, 92% of global technologists acknowledge that the urgency to innovate and adapt to evolving customer needs has often resulted in compromised application security during software development. As a consequence, organizations have become susceptible to security vulnerabilities and threats. They face broader attack surfaces and gaps in their application security layer due to the isolation of teams. These teams face challenges in obtaining adequate visibility and the necessary business context for prioritizing vulnerabilities. Consequently, organizations are witnessing a surge in security incidents within the modern environment, thereby jeopardizing customer data and the reputation of their businesses. Mark Leary, Research Director, IDC, stated, Cisco's extensive domain experience across multi-cloud and hybrid environments and comprehensive full tech stack oversight positions the company well to assist customers bring business risk observability, application observability, and security intelligence data together. Combined, they give customers access to the critical information they need to make smarter decisions about their application security [Source – Cision PR Newswire] Senior VP and General Manager of Cisco Full-Stack Observability and AppDynamics, Ronak Desai, said, An organization's ability to swiftly assess risks based on potential business impact, align teams and triage threats is entirely dependent on understanding where vulnerabilities exist, the severity of those risks, the likelihood they’ll be exploited, and the risk to the business of each issue. This business risk observability can enable IT professionals understand and prioritize those risks and is uniquely delivered by Cisco. The availability of Cisco Secure Application on the Cisco Full-Stack Observability platform is a crucial next step in our commitment to providing customers with the tools they need to provide unmatched and secure digital experiences across multi-cloud and hybrid environments. [Source – Cision PR Newswire]

Read More