Security Weekly RSAC 2019: Improving Incident Analysis with Deception-Generated Data

Security Weekly interview with Nir Greenberg, Director of Customer Success at Illusive Networks

For Incident Response (IR) teams, cyber forensics gathering and analysis can sometimes feel like treading water in the deep end of a pool. While the objective is clear—once a security incident is detected, to investigate it using digital forensics as rapidly and effectively as possible—there are several challenges to achieving it.

Often understaffed IR teams, without much real incident response experience in the SOC, must execute multiple collection processes and mine volumes of log files filled with too much or irrelevant data. As time passes volatile system data is lost or unavailable in time to fully understand the context of the incident. Ultimately, an incomplete picture is formed causing them to make hasty, and often wrong, decisions.

To overcome these challenges, forensic analysts need precise, real-time forensics, presented in an actionable format. When presented with a picture of potential business risk for each incident, IR teams can prioritize each incident and determine the most effective response.

In this video interview with Security Weekly, Nir Greenberg, Director of Customer Success, explains how Illusive works with customers to ensure they have the forensics collection technology needed to prioritize incidents, gain deep insight on the attacker, and respond to minimize business impact.

Watch the video to learn:

  • The challenges of incident response once an attacker is detected with a deception inside a network
  • How Illusive is effective in forensics gathering which alleviates the need for separate forensics tools
  • The value of both source (endpoint) and target (decoy) forensics, giving a 360° view of the attacker’s attempt to move laterally inside a network
  • How the Illusive Forensics Timeline presents a roll-up of all incident data in an easy-to-use, time-stamped and sortable format

When an alert has fired and a cyberattack is in progress, time is critical. Illusive’s Attack Intelligence System provides simple, precision forensics so incident responders can act quickly to minimize business damage and improve future cyber resilience.