Freely subscribe to our NEWSLETTER

Requirement 11.4 calls for “use of network intrusion detection systems and/or intrusion prevention systems to monitor all traffic in the cardholder data environment and alert personnel to suspected compromises.” LightCyber Magna goes well beyond these requirements by providing full visibility into the entire attack lifecycle, rather than just the initial intrusion vector. Magna works by finding the anomalous operational behaviors of malicious insiders and external attackers rather than just finding known threats using attack signatures.

The LightCyber Magna platform uses behavioral profiling to learn what is normal on the network and endpoints, allowing it to detect behavioral anomalies that are indicative of an attack, including both external attackers and internal attackers. These behaviors can be identified early to reduce attacker dwell time and curtail attack activity. Magna presents a small number of actionable alerts with supporting contextual and investigative details to greatly enhance the efficiency of a security operations team in its detection and remediation operations.

A recent LightCyber customer, Arriva Trains, was challenged by their QSA to not only fulfill PCI DSS but to also detect successful network attackers. Their auditor asked, “If you had an attacker on your network, how would you be able to detect it?”

Now, with LightCyber Magna deployed, Arriva Trains has addressed the PCI DSS breach detection requirements, while also achieving high levels of network visibility and giving them the ability to find a potential attacker early before theft or damage occurs.

Network Traffic Analysis (NTA) solutions such as LightCyber Magna are ideally suited for uncovering post-intrusion activity, including internal reconnaissance and lateral movement, that cannot easily be identified through traditional attack signatures. In the Gartner report published September 20, 2106, Defining Intrusion Detection and Prevention Solutions (G00310148), analysts Craig Lawson, Adam Hils and Claudio Neiva note that "Gartner has seen clients consider other NTA and breach-detection technologies instead of or as something different from IPS. For example, you have already deployed an NGFW and are comfortable with its IPS effectiveness, then subsequently opt for a dedicated NTA prevention instead of a discrete IPS is an option Gartner see’s clients pursuing.”