“Given the inevitability of a security breach, large organizations must supplement Advanced Malware Detection/Prevention network and host-based controls with effective and efficient incident response policies, processes and metrics,” said Jon Oltsik, Senior Principal Analyst, Enterprise Strategy Group (ESG).1 “Many security solutions were designed for advanced malware detection and blocking alone, and lack the intelligence and integration necessary for incident detection and response. One notable exception of products and services comes from network security leader Sourcefire.”
The Sourcefire Incident Response team assists customers in diagnosing, identifying and remediating risks using Sourcefire technology. Sourcefire advanced malware protection for FirePOWER™ and FireAMP™ use security big data analytics and collective intelligence to deliver integrated, advanced malware protection from the network to end-devices. The Incident Response team helps customers leverage the intelligence these solutions provide, including forensic data, continuous file analysis, and visibility into file trajectory and behavior, to make more informed security and incident response decisions across the entire advanced malware lifecycle.
Using best practices for incident response and a structured approach to incident evaluation, the Sourcefire experts act as an extension of the customer’s team to identify risk and minimize it in the future. Services include incident investigation to determine the method(s) of attack employed by the attacker throughout the course of the incident; countermeasure development to detect and stop attacks; assistance in deploying countermeasures according to best practices; and validation of countermeasure effectiveness and recalibration as needed to ensure ongoing protection.
“Advanced malware protection is not just about having the right technologies in place but also the right response when the technologies identify an event,” said Jonathan Goldberger, vice president of professional services for Sourcefire. “Our incident response service helps our customers bridge the knowledge and experience gap so that they can take a more proactive stance to identifying, mitigating and eliminating risks using the intelligence from FireAMP and advanced malware protection for FirePOWER.”
Discover the 4 Dimensions of Incident Response during the complimentary webinar, “Malware War Stories.”
About Sourcefire Professional Services
Sourcefire Professional Services combines a sophisticated and empirical approach to customer satisfaction with more than a decade of thought leadership in cybersecurity technologies. All offerings are based on best practices maintained by Sourcefire and derived from Information Security Standards (CISSP Domains, ISO 27000 series, etc.), compliance standards (PCI, HIPAA, SOX, FISMA, etc.) and our extensive experience deploying, architecting, tuning and securing environments globally.
Sourcefire, Inc. (Nasdaq:FIRE)
Sourcefire, the Sourcefire logo, Snort, the Snort and Pig logo, Agile Security and the Agile Security logo, ClamAV, FireAMP, FirePOWER, FireSIGHT and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. Other company, product and service names may be trademarks or service marks of others.
1 Source: ESG Brief: Advanced Malware Protection Must Extend to Incident Detection and Response, December 2012.
For further information, please contact:
OAK Consulting FZ LLC