Download presentation
Presentation is loading. Please wait.
1
Infocyte HUNT TM Platform
The Leader in Post Breach Detection
2
Attackers Continue to Evade Security Defenses
They get in They expand and hide They are tough to detect of Threats go undetected by automated security tools1 Average time attackers dwell on networks until discovered of SOCs top challenge is detection of hidden, unknown, and emerging threats1 12017 Threat Hunting Report, Crowd Research Partners
3
Attacker Dwell Time: The Central Issue
Exploitation Installation Command & Control Lateral Movement Exfiltration Persist Real-Time Prevention & Monitoring Threat Hunting Containment, Eradication & Recovery Attack In Progress Attacker Dwell Time Response Network Breached Incident Discovered Reconnaissance
4
The faster you hunt and contain breaches, the smaller the financial impact
Reducing Dwell Time is Key Organizations that are able to contain a breach in less than 30 days paid nearly $1 million less in total breach costs.* *Ponemon Institute 2017 Cost of Data Breach Study: Global Overview
5
Where We Fit Endpoint Protection Platforms (EPP) Hunt Platforms (HP)
Real-Time Prevention & Monitoring Threat Hunting Containment, Eradication & Recovery Reconnaissance Exploitation Installation Command & Control Lateral Movement Exfiltration Persist Attack In Progress Post Breach Activity Incident Response Endpoint Protection Platforms (EPP) Hunt Platforms (HP) Incident Response Platforms (IR) Block known attack entry and/or malware installation Detect post breach activity and persistence that has bypassed EPP and EDR solutions Identify exact endpoints that need remediation Triage IR activity and workload Breach breadth and depth identification, containment, eradication, recovery and hardening against future attacks Root cause and impact assessment via log, alert, and traffic analysis Endpoint Detection and Response (EDR) It’s a nit, but I’d drop the “HP”, let people just call it Hunt Platforms just as with Forensics Solutions. Detect attacks in progress based on application behavior & IOCs Collect event history for big data investigation & downstream IR User Entity & Behavior Analytics (UEBA) User / device behavioral anomaly analytics
6
Threat Hunting Approaches Vary Dramatically
Endpoint Detection & Response (EDR) User & Entity Behavior Analytics (UEBA) Forensic State Analysis (FSA) Manual hunt through historical search and analysis of early kill chain indicators Manual hunt through behavior anomaly analysis Automated hunt through state analysis of late stage kill chain indicators Detects signals based on app behavior and IOCs Historical search Quarantining Remediation / restoration Anomalies relative to “standard” profiles and behavior (unsupervised ML common) Ingests Existing Data: User, host, app, traffic, and data storage Analyzes endpoint state including volatile memory, forensic artifacts, and OS integrity Identifies backdoors, O/S manipulation, forensic evasion, suspicious connections, and persistence Technology Data science and security expertise Big data and data mining analytics Elite understanding of evolving attacker craft Learning periods and protracted tuning Requires known-good baseline Results: Normal vs Not Normal Human required to discern good from bad No learning period No advanced skill sets necessary No reliance on existing infrastructure Low Ops impact Requirements
7
What Sets Infocyte HUNT Apart
Forensic State Analysis Memory Analytics Endpoint Characteristics Forensic Analysis Infocyte HUNT finds conclusive evidence of post breach activity that other hunt tools are prone to miss. This is made possible by the sheer depth and breadth of memory analysis supported by our FSA technology. Specifically, we provide targeted surveying of volatile memory, forensic artifacts, and OS integrity. Infocyte HUNT takes memory forensics to an entirely new level of scalability - by surveying the live memory of thousands of endpoints simultaneously. FSA also analyzes OS and application persistence mechanisms – which can trigger the execution of code or executables. This provides a far deeper, and more conclusive, examination of an endpoint’s state. File Intelligence Services Reputation Services Data
8
Infocyte HUNT 100% focused on Post Breach Detection Most Conclusive
Scalable live, volatile memory analysis and largest repository of persistence mechanisms Proactive discovery of threats and compromises already inside the network Easiest to use Agentless model requires no change management and is extremely lightweight in your environment Scales to tens of thousands of nodes Most Cost-Effective “Zero to Hero” in hours to days—not months or years Reduces dwell time to limit damage and costs Infocyte approaches threat detection from a completely new perspective – by presuming endpoints are already compromised. Infocyte Hunt provides an easy-to-use, yet powerful solution to limit risk and manage the breach detection gap. Proactively discover active or dormant malware and persistent threats that have successfully evaded existing defenses - all without a forensics specialist. Infocyte's agentless threat hunting platform for Windows and Linux rapidly assesses network endpoints for evidence of compromise – without complicated equipment or endpoint software installations. Reports score the severity of identified issues for swift resolution and risk mitigation.
9
Use Case: Threat Hunting
Full Scope Hunting Conduct sweeps of thousands of networked endpoints using forensic techniques to proactively discover threats Automation saves time and money Useful for both junior and experienced security personnel Targeted Hunting Triage security data via other analytics Create target list and scan subset of machines having suspicious indicators
10
Use Case: Compromise Assessments
A periodic evaluation of networked devices to detect threats that have evaded existing security controls Effective at detecting presence of malware, remote access tools, and other indications of unauthorized access Fast – Assess thousands of endpoints per day Affordable – A typical organization should be able to conduct it proactively and regularly (i.e. quarterly) without outside consultants Independent – The assessment does not rely on existing detection solutions already in the environment APPLICATIONS Risk Management & Mitigation Mergers & Acquisitions Third Party & Vendor Risk Management Security Program Validation / Audit
11
Use Case: Alert Validation
Infocyte HUNT provides an automated solution to help validate alerts from your SIEM, network or endpoint product Performs a scan of the endpoint in question to determine if the threat is real. Weeds out false positives and quickly identifies which alerts to escalate. Reduces the time and resources needed to manually comb through volumes of false and low priority alerts. Allows your security team to focus on remediating real threats. Leverages your existing security investments. - SIEM Alert from network or host-based monitoring drives automatic API-driven scan of affected endpoint - Infocyte returns conclusions and/or raw forensic data to SIEM
12
Infocyte HUNT Advantages
FORENSIC DEPTH Detects post breach activity that other hunt tools are prone to miss Targeted surveying of volatile memory, forensic artifacts, and OS integrity Live memory analysis - as opposed to static file export analysis BECOME THE HUNTER Automates the threat hunting process Enables your IT and security teams to hunt without specialized knowledge EASY TO IMPLEMENT Agentless surveys are fast and lightweight Full independence from existing security stack Able to survey thousands of endpoints simultaneously vs. 'single endpoint at a time’ alternatives FAST ROI “Zero to Hero” in hours to days— not months or years No expensive consultants required Reduces dwell time to limit breach damage and costs
13
Overall APT Solution of the Year Best Computer Forensic Solution
Industry Recognition Overall APT Solution of the Year NETWORK WORLD REVIEW TOP 3 THREAT HUNTING PRODUCT Best Computer Forensic Solution
14
Infocyte HUNT Architecture
Third Party Threat Intel Incyte™ Cloud Service Infocyte Lab File Intelligence Services Digital Forensic Analytic Services (executables, modules, injected memory) ON-PREMISES* Infocyte HUNT™ Server Database HUNT Core Service API UI Analyst Workstation Endpoints * Complete on-premises solution available for government
15
Seeing is Believing – Product Demonstration
1 2 3 Asset Discovery & Scanning Start Point Reporting Endpoint Analysis Results 4 5 6 Volatile Memory Analysis Advanced Analysis Attacker Movement Visualizations
16
The Leader in Post Breach Detection
17
Splunk + Infocyte Integration A single pane of glass approach to security with innovative data-centric endpoint threat hunting
18
Infocyte HUNT App for Splunk
Infocyte provides true endpoint hunting / threat discovery It answers the question: Are you compromised? Splunk provides comprehensive enterprise analysis and data-centric hunting It answers the question: How was I compromised? Infocyte + Splunk = More comprehensive threat hunting and incident response
19
Integration Benefits Reduced Incident Resolution Time
Pivots from Infocyte findings to historical logs and machine data for faster correlation and investigation Trend Analysis and Reporting Customized search, display and reporting of hunt findings over time Alerting and Event Triggers Trigger endpoint scans based on SIEM / Sensor alerts Single Pane of Glass Security Integration of the two platforms enables single pane of glass for security management, and data collection analysis
20
Splunk App Solution Overview
21
Case Studies
22
Case Study: Banking & Finance
Case Study: Banking & Financial Services Case Study: Banking & Finance Organization The acquirer is a major financial institution based in the US with over a trillion dollars in assets. The acquiree is a 50 employee wealth management firm in the US serving high net worth clients and managing over a Billion dollars in assets. Challenge As part of M&A due diligence the acquirer needed to independently verify the health of IT the acquiree’s IT systems and ensure no breaches had occurred. Solution Compromise Assessment using Infocyte HUNT™ Results 5 days to scan, analyze and report on 54 workstations and servers active on the network. Found machines that were not using corporate standard antivirus so that they could be remediated. Showed the acquiree had strong technical controls, regular security hygiene (i.e. nightly reboots), and IT policies in place to protect the network. Provided a clean bill of health for the network. Ensured confidence that the acquiree’s systems and data were clean and secure for the transaction to progress. In the end, the assessment lasted five days from the initial engagement to the final report. Infocyte was able to verify the integrity and confidentiality of the business’ information systems to the Acquirer at an unprecedented level compared to traditional due diligence methods.
23
Case Study: Public Transportation
Organization A metropolitan mass transit agency (“Metro”) serving a major US city and surrounding municipalities. Challenge In the face of increasing cyber risk to public infrastructure, Metro took steps to understand their current security posture and assess the need for more advanced security investments. Solution Compromise Assessment using Infocyte HUNT™ Results Two (2) days to scan 1000 systems. Despite enterprise-grade security, Metro was infected with six (6) variants of malware – some active as far back as 3 years. Metro was able to quickly identify and remediate the issues before they could cause any significant damage. Without a compromise assessment, Metro’s security problems would have continued to go undetected and it would have been difficult to provide tangible evidence to warrant increasing their security posture.
24
Case Study: Pierce Transit Public Transportation
Organization Pierce County Public Transportation Benefit Area Corporation (Pierce Transit) is a nationally recognized leader in the public transportation industry. Challenge Understand if any malware or advanced persistent threats (APT) were residing on the network, lying dormant or active Solution Compromise Assessment using Infocyte HUNT™ Results Over 600 endpoints enumerated and scanned by Infocyte HUNT Clean bill of health with no malware or APTs present on the network Easy to understand compromise assessment report for executives and IT staff Non-invasive technology easily implemented and quick to scan and assess “To complete a full evaluation internally without Infocyte HUNT, we would require two additional staff and over a month to evaluate our network and servers. With Infocyte’s methodology and hunt technology, we had a cost-effective solution in place that in a matter of days gave us the reassurance that our systems weren’t compromised.”
25
Case Study: U.S. Catholic Archdiocese NON-PROFIT
Organization Regional U.S. Catholic Archdiocese with thousands of parishioners, and multiple locations, both educational and religious. Challenge Understand if any malware or advanced persistent threats (APTs) were residing on network endpoints, lying dormant or active. Protect IT infrastructure and data including personal information such as Social Security Numbers, bank account information, payment card data, contact information of parishioners, employees and students. Solution Infocyte HUNT™ Results All endpoints surveyed and validated by Infocyte HUNT Deep visibility into the organization’s endpoint state Empowers the existing IT team to effectively hunt for hidden threats “Infocyte was the proactive solution the Archdiocese had been looking for to reduce risk and increase security. Simply stated, it provides the ultimate offensive attack plan and allows us to have deeper visibility into the state of our endpoints through an easy to use interface that I can quickly train staff to use.”
26
Join the Infocyte HUNT Team
Offer customers the leading post breach detection solution
27
Infocyte Partnerships Create Value & Drive Opportunity
Offer customers the leading post breach detection platform No program participation fees Expand your services portfolio Competitive discounts Recurring revenue stream with exceptional renewal rates Deal registration protection Sales and marketing support Training available
28
Create New Revenue Streams
RESELL the Infocyte HUNT Platform Add value by adding an innovative threat hunting solution created by former US Air Force cyber hunters to your portfolio. Earn significant margins by selling subscriptions to the tool with exceptional renewal rates. MSSP engagements offer the ability to provide ongoing management of the Infocyte tool. Easily Add COMPROMISE ASSESSMENT SERVICES Infocyte HUNT can be utilized by your team to conduct Compromise Assessments for customers at a fraction of the price and time of competitors. Compromise Assessments can be completed 10 times faster than assessments performed manually using traditional security monitoring and incident response solutions. Drive Revenue with SERVICES ENGAGEMENTS Infocyte Services Partners recommend products and provide services including: Compromise Assessments Implementation/deployment Training Advanced analytics Incident Response Provide customers with threat hunting services and consulting, and let Infocyte manage the sales process.
29
Partnerships To Fit Your Business Model
Technology Partners Together with our technology partners Infocyte is able to build more effective, innovative solutions to stop malware and persistent threats across the network and endpoints. Infocyte works with technology partners to collaborate on technical integration, go to market programs, and more, to bring our innovative approach to threat hunting to customers. Resellers & Distributors Infocyte Resellers and Distributors enjoy the many benefits of partnering with the leader in threat hunting. We offer our partners an innovative hunt product, high margins, and deal protection. The Infocyte Reseller and Distributor program is committed to building successful, long-term relationships that benefit both our partners and their clients. Service Providers Infocyte Services Partners recommend products and provide services from Compromise Assessments to implementation, deployment, training and advanced analytics. This is a great option for organizations that want to provide customers with threat hunting services and consulting, but prefer to let Infocyte manage the sales process.
30
Partner Close Up: Global Cybersecurity Services Provider
Organization Global provider of advanced cybersecurity services offers a combination of cutting-edge technology, experienced staff, and proven processes to their customer base across a broad range of industries. Challenge Despite having an arsenal of AV, Firewall, Intrusion Detection and other security tools at their disposal, the reseller saw a need for a post breach detection solution to combat malware and APTs. They heard about Infocyte from a news article and reached out about a POC and partnering opportunities. Partnering Model Resell and Provide Managed Services for Infocyte HUNT™ Results Expanded solution portfolio to include threat hunting. Able to find threats using Infocyte HUNT that other solutions in their portfolio could not find. For example, Infocyte was the only solution that could find the presence of the "minerd" cryptocurrency miner malware on a customer’s network. Immediate sales/revenue returns with multiple accounts, with opportunities for future expansion within these accounts. Built $1M pipeline in 6 months.
Similar presentations
© 2025 SlidePlayer.com Inc.
All rights reserved.