Attivo Networks ThreatDefend Endpoint Detection Solution
Promote this Nomination
Photo Gallery
|
|
Attivo Networks ThreatDefend Endpoint Detection Solution
Additional Info
| Company (that provides the nominated product / solution / service) | ATTIVO NETWORKS |
| Website | https://attivonetworks.com/ |
| Company size (employees) | 100 to 499 |
| Type of solution | Software |
In 3 bullets, summarize why this product or service is different from the competition and deserves recognition:• The solution provides capabilities to monitor available services on production endpoints, and redirects attempted access into a deception environment. Every endpoint on the network effectively becomes a decoy and, when paired with the company’s deception lures, locks down an attacker’s ability to break out from the system without getting caught. |
Overview
The Attivo Networks Endpoint Defense changes the game so that attackers can’t break out from the endpoint.
The ThreatDefend offerings interweave deception throughout the network and also turn every endpoint into a decoy designed to disrupt an attacker’s ability to break out without installing agents or disrupting network operations. The attack methods detected include, but are not limited to:
• Stealing local credentials
• Looking for file shares and connected systems
• Network reconnaissance as they look for hosts (production assets) and available services on these hosts
• Active Directory queries with the ability to hide information and return deceptive data to queries
• Man-in-the-Middle attacks where attackers steal credentials in transit
Locking down the endpoint with deception dramatically reduces risk by detecting attacks early and preventing lateral movement. Plus, alerts are substantiated, actionable, and provide company-centric threat intelligence for stopping an attack, hunting threats, and remediating faster.
• Locks down lateral movement from the endpoint in an efficient and agentless manner. In a recent EMA survey, deception customers cite 5-day dwell times and high confidence in detecting threats. This result was 90% better than users unfamiliar with deception technology.
• Creates deception credentials that identically match those of the system user. They are crafted to mirror-match, dynamically refresh timestamps, and they appear as any other credential would. They are so authentic that Red teams and tools like HoneypotBuster can’t tell the difference. These credentials breadcrumb the attacker into the deception decoy environment.
• Mapped shares attract attackers into the decoy environment, along with native integrations with existing endpoint solutions that can automatically quarantine the infected system. Additionally, the solution will “entertain” the attacker with reams of fake data, providing time to isolate the system and prevent further spreading.
• Network discovery attempts get derailed as the Attivo deception fabric interweaves decoy endpoints throughout the environment, with support for Microsoft, Linux, and Mac OS
