Overview

Whether perpetuated by nation-states, criminal enterprises or terrorist organizations for advancement of their various causes, each year there are a growing number of critical cyber attacks.

In an engagement with a U.S. DoD agency, the Lumeta Federal Professional Services team deployed Lumeta ESI across the enterprise network (>0.6 million devices) for a real-time cyber defense solution including network behavior analytics and cybersecurity breach detection.

Lumeta ESI provides the agency with network situational awareness including:

• An authoritative index of the network architecture, starting with a baseline, and:
o Identification of newly inserted, possibly rogue, wireline or wireless infrastructure devices, firewall, routers or other network functions (e.g., virtualized) acting as packet forwarders
o Identification of any new virtual/cloud IaaS (or physical) resource seeking service from the network

• Validation of network segmentation policies (or violations of policy):
o Real-time identification and mapped views of newly identified networks and newly inserted routes
o Real-time identification of routed (L3) or bridged (L2) “leak paths” or other connectivity between protected network enclaves

• Operationalizing threat intelligence and other external data feeds to detect cybersecurity breaches:
o Real-time discovery of use of Dark Web/TOR exit nodes from locations inside the government enterprise
o Identification of unauthorized use of services which may be utilized for lateral movement or exfiltration of data like RDP, X11, FTP, DNS
o Real-time and forensic analysis of threat flows (“conversations”) occurring between devices on the network and known malware command and control (C2) servers

The agency has enterprise rollup portal visibility at the cybersecurity operations center and units throughout the agency.

The solution scales globally to encompass the enterprise network in all locations (within and outside the continental United States).