News
Arbor Networks Introduces Pravail® Security Analytics for Advanced Threat Detection, Incident Response and Security Forensics
March 2014 by Marc Jacob
Arbor Networks Inc. introduced Pravail Security Analytics for advanced threat detection, incident response and security forensics. The technology delivering this solution was developed by Packetloop, a Sydney, Australia-based innovator in the field of Big Data Security Analytics that was acquired by Arbor in September 2013.
Global Attack Intelligence for Local Protection
The attack intelligence that keeps Pravail Security Analytics at the cutting edge of network security comes from Arbor’s ATLAS® Active Threat Level Analysis System. ATLAS is a collaboration with nearly 300 service providers who share anonymous data with Arbor, up to 70TB/sec of global Internet traffic. This collective view delivers globally scoped insight into the attack landscape. This data set is analysed by Arbor’s security research team who then develops detection methodologies; and creates fingerprints that identify threats and malicious activity occurring within the enterprise.
Reveal Attacks Hidden within Your Global Network
Today’s breed of attacker is not looking to be a short-term and visible nuisance. They use stealthy and sophisticated methods to penetrate an organisation’s perimeter and the indicators of compromise are often impossible to identify before it’s too late. In order to really understand subtle, advanced targeted attacks, enterprises need a complete record of all network traffic. By analysing data very quickly, Pravail Security Analytics can be used for real-time attack response decisions, and by storing the data for future reviews, it can be looped to identify previously undetected attacks using the latest threat intelligence.
Rapid Deployment, On-Premise or In the Cloud
Pravail Security Analytics uses big data technologies that lower the barrier to entry for organisations looking to deploy and operate world-class security analytics. An organisation can securely upload packet captures to Pravail Security Analytics in the Cloud and be analysing their data within minutes of a threat being identified. For organisations that cannot upload their packet captures for compliance or regulatory reasons, Pravail Security Analytics can also be deployed as an on-premise solution using distributed Collector appliances. The Collector appliances can be used to scale out storage or processing capabilities for high speed capture points, or for deployment into multiple locations to provide distributed coverage. Most importantly, the Collector appliances operate in real-time, streaming the security analytics data to the Controller for analysis with virtually no delay. This means security analysts can track attacks live, as they happen, or perform post hoc analysis with stored and uploaded packet captures.
By using Controllers and Collectors, Pravail Security Analytics can support three flexible deployment architectures:
· Pravail Security Analytics Cloud - where the Controller is the Pravail Security Analytics cloud platform. Data is uploaded in the form of packet captures and processed in the cloud.
· On-Premise Collector to Cloud Controller - A collector is deployed on your network and processes real-time network streams. The results are encrypted and streamed to the cloud where they are analysed.
· On-Premise Collector to On-Premise Controller - in this model nothing leaves your network. Data is collected and processed within your network and streamed to a Controller within your network.
The technology in the Collectors can scale to meet network speeds, length of packet capture retention (for looping) and real-time processing speed. This means that full real-time functionality of Pravail Security Analytics is available for network speeds in excess of 10Gbps. Big Data Security Analytics on a grand scale. Collectors are available in multiple physical appliance form factors as well as Virtual Machines. Controllers can also be scaled but aren’t as heavily utilised as Collectors. They store all the metadata and make it available for analysis and can scale to support decades of processed data. At this time Controllers are only available in a physical appliance or of course by leveraging the cloud platform.
A production demonstration of the Cloud solution is available that leverages pre-existing data sets. This enables the user to test drive the solution and see its powerful capabilities firsthand. A free trial of the Cloud solution is also available, enabling users to quickly analyse their own network packet captures for threats, anomalies and misuse. The free trial allows users to upload up to 1GB of their data for thirty days.
General availability of the Pravail Security Analytics on-premise Collector solution is planned for April 30, 2014.
